Use-after-free in NGINX Plus and NGINX Open Source - CVE-2026-56434

Vulnerability identifier: #VU137845

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-56434

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service or modify memory contents.

The vulnerability exists due to use-after-free in the ngx_http_ssi_module module when processing responses from an upstream server with SSI enabled, proxy_pass configured, and proxy_buffering disabled. A remote attacker can control responses from an upstream server to cause a denial of service or modify memory contents.

Exploitation requires man-in-the-middle ability over upstream server responses. This is a data plane issue only.

NGINX Plus
NGINX Open Source
Gentoo Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
openEuler
Ubuntu
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx (Ubuntu package)
nginx-mod-mail
nginx-debugsource
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx
nginx-debuginfo
nginx-mod-stream
nginx-all-modules
nginx-filesystem
nginx-help
nginx (Red Hat package)
nginx-core
nginx-doc
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P7, 37.0.3.1
NGINX Open Source - addressed in versions 1.30.4, 1.31.3
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-11.fc45
nginx-mod-vts - update to 0.2.4-13.fc45
nginx-mod-fancyindex - update to 0.6.0-8.fc45
nginx-mod-headers-more - update to 0.40-3.fc45
nginx-mod-brotli - update to 1.0.0~rc-13.fc45
nginx-mod-modsecurity - update to 1.0.4-16.fc45
nginx-mod-naxsi - update to 1.6-21.fc45
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.17, 1.18.0-6ubuntu14.18, 1.18.0-6ubuntu14.19, 1.18.0-6ubuntu14.20, 1.24.0-2ubuntu7.14, 1.24.0-2ubuntu7.15, 1.24.0-2ubuntu7.16, 1.24.0-2ubuntu7.17, 1.28.3-2ubuntu1.7, 1.28.3-2ubuntu1.8, 1.28.3-2ubuntu1.9, 1.28.3-2ubuntu1.10
nginx-mod-mail - update to 1.21.5-19
nginx-debugsource - update to 1.21.5-19
nginx-mod-http-xslt-filter - update to 1.21.5-19
nginx-mod-http-perl - update to 1.21.5-19
nginx-mod-http-image-filter - update to 1.21.5-19
nginx-mod-devel - update to 1.21.5-19
nginx - update to 1.21.5-19
nginx-debuginfo - update to 1.21.5-19
nginx-mod-stream - update to 1.21.5-19
nginx-all-modules - update to 1.21.5-19
nginx-filesystem - update to 1.21.5-19
nginx-help - update to 1.21.5-19
nginx (Red Hat package) - update to 1.26.3-6.el10_2.6
nginx-mod-devel - update to 1.30.4-1
nginx - update to 1.30.4-1
nginx-core - update to 1.30.4-1
nginx-filesystem - update to 1.30.4-1
nginx-mod-http-image-filter - update to 1.30.4-1
nginx-mod-http-perl - update to 1.30.4-1
nginx-mod-http-xslt-filter - update to 1.30.4-1
nginx-mod-mail - update to 1.30.4-1
nginx-mod-stream - update to 1.30.4-1
nginx-all-modules - update to 1.30.4-1
nginx-doc - update to 1.30.4-1
nginx - update to 1.30.4-1.fc45
www-servers/nginx - update to 1.31.3-r1

• https://my.f5.com/manage/s/article/K000162098

• Multiple vulnerabilities in NGINX Open Source
• Ubuntu update for nginx
• Ubuntu update for nginx
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• openEuler update for nginx
• Gentoo update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Red Hat Enterprise Linux 10 update for nginx
• Red Hat Enterprise Linux 9 update for the nginx:1.24 module