NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process.
This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Attack Parameters
Impact Assessment
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 19
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
F5 Nginx_Gateway_Fabric
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
|
1.3.0
|
<= 1.6.2
|
|
F5 Nginx_Gateway_Fabric
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
|
2.0.0
|
2.6.7
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*
|
3.5.0
|
<= 3.7.2
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*
|
5.0.0
|
5.5.3
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:long-term_support:*:*:*
|
2026-lts-r1
|
2026-lts-r4
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
|
37.0.0.1
|
37.0.3.1
|
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
|
r33
|
r36
|
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p6:*:*:*:*:*:*
|
— | — |
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
4.11.0
|
<= 4.16.0
|
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
5.2.0
|
<= 5.8.0
|
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
5.9.0
|
5.13.4
|