CVE-2026-56434

Published Jul 15, 2026

Last updated 2 months ago

Openresty

web application

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-56434 is a use-after-free vulnerability found in the `ngx_http_ssi_module` of NGINX Plus and NGINX Open Source. This flaw specifically manifests when Server-Side Includes (SSI), `proxy_pass`, and `proxy_buffering off` directives are configured simultaneously. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this vulnerability by controlling responses from an upstream server. This can trigger a use-after-free condition within the NGINX worker process, potentially leading to limited modification of memory contents or a restart of the NGINX worker process.

Description: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: f5sirt@f5.com
NVD status: Analyzed
Products: nginx_gateway_fabric, nginx_ingress_controller, nginx_plus, waf

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 4.2
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Severity: MEDIUM

Weaknesses

f5sirt@f5.com: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE",
            "versionEndIncluding": "1.6.2",
            "versionStartIncluding": "1.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0E26414B-CC24-4618-80C5-4B96013A8920",
            "versionEndExcluding": "2.6.7",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "E54B5C35-49D7-43F6-B57C-4606F75192CE",
            "versionEndIncluding": "3.7.2",
            "versionStartIncluding": "3.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "2156F0F4-1515-45E7-8A13-F653F3796CAF",
            "versionEndExcluding": "5.5.3",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:long-term_support:*:*:*",
            "matchCriteriaId": "95CF6424-294F-41A0-B28C-B35862F3D9E5",
            "versionEndExcluding": "2026-lts-r4",
            "versionStartIncluding": "2026-lts-r1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "109F4C2E-4A5E-4B5E-B282-21AFD52AEC60",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "717D820A-78A2-41EF-BB3C-5745B6D954C1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A1E34F4A-5F43-4048-9216-5A8AABD33F72",
            "versionEndExcluding": "37.0.3.1",
            "versionStartIncluding": "37.0.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "87DE2F03-FB1E-48DC-9EEE-B3268BB4C615",
            "versionEndExcluding": "r36",
            "versionStartIncluding": "r33",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*",
            "matchCriteriaId": "E7E5F940-048A-446F-9A1E-074612CEA1AC",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*",
            "matchCriteriaId": "7993A0FB-BE7E-4634-BF7F-FDEE3582D3E7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*",
            "matchCriteriaId": "862EA47E-8D57-434E-9C8F-238325FB85B2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:*:*:*:*",
            "matchCriteriaId": "7B52C01B-F719-4C72-BB83-7B70EC4BC029",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:*:*:*:*",
            "matchCriteriaId": "9F2211E4-93B9-4F1F-BA32-F5C34B879688",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:*:*:*:*",
            "matchCriteriaId": "284E9DB5-02EB-40E9-9DF3-E8F8144775ED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p6:*:*:*:*:*:*",
            "matchCriteriaId": "0680DC66-0B6F-4E86-B0E6-BCC235A837CE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "021B6D53-5F4A-4A4B-AC2F-CFBEC338F69F",
            "versionEndIncluding": "4.16.0",
            "versionStartIncluding": "4.11.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "2DB79E6C-08B0-4341-BCBE-B8070DDAA7AF",
            "versionEndIncluding": "5.8.0",
            "versionStartIncluding": "5.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "4EA246F7-5222-4403-BFEA-160195FD39B2",
            "versionEndExcluding": "5.13.4",
            "versionStartIncluding": "5.9.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.