CVE-2026-56434
published 2026-07-15CVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI)…
PriorityP341medium6.5CVSS 3.1
AVNACHPRNUINSUCNILAH
EPSS
0.42%
35.2th percentile
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | nginx_gateway_fabric | 1.3.0 – 1.6.2 | — |
| f5 | nginx_gateway_fabric | >= 2.0.0 < 2.6.7 | 2.6.7 |
| f5 | nginx_ingress_controller | — | — |
| f5 | nginx_ingress_controller | — | — |
| f5 | nginx_ingress_controller | >= 2026-lts-r1 < 2026-lts-r4 | 2026-lts-r4 |
| f5 | nginx_ingress_controller | 3.5.0 – 3.7.2 | — |
| f5 | nginx_ingress_controller | >= 5.0.0 < 5.5.3 | 5.5.3 |
| f5 | nginx_open_source | >= 0.8.11 < 1.30.4 | 1.30.4 |
| f5 | nginx_open_source | >= 1.31.2 < 1.31.3 | 1.31.3 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= 37.0.0.1 < 37.0.3.1 | 37.0.3.1 |
| f5 | nginx_plus | >= R33 < * | * |
| f5 | nginx_plus | >= R36 < R36 P7 | R36 P7 |
| f5 | nginx_plus | >= r33 < r36 | r36 |
| f5 | waf | 4.11.0 – 4.16.0 | — |
| f5 | waf | 5.2.0 – 5.8.0 | — |
| f5 | waf | >= 5.9.0 < 5.13.4 | 5.13.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu8.1HIGH
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerability
vendor_ubuntu·2026-09-14·CVSS 8.1
CVE-2026-42533 [HIGH] nginx vulnerability
Title: nginx vulnerability
Summary: USN-8563-1 introduced a regression in nginx
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was
backed out in USN-8563-2 because it could cause a regression. This update
includes a better fix for CVE-2026-42533.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives.
Ubuntu
nginx vulnerability
vendor_ubuntu·2026-08-19·CVSS 8.1
CVE-2026-42533 [HIGH] nginx vulnerability
Title: nginx vulnerability
Summary: A security issue was fixed in nginx.
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was
backed out in USN-8563-2 because it could cause a regression. This update
includes a better fix for CVE-2026-42533.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An atta
Ubuntu
nginx regression
vendor_ubuntu·2026-08-19·CVSS 8.1
CVE-2026-42533 [HIGH] nginx regression
Title: nginx regression
Summary: USN-8563-3 introduced a regression in nginx
USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression
in certain environments. This update reverts the fix for CVE-2026-42533
pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An attacker abl
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 8.1
CVE-2026-56434 [HIGH] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An attacker able to
intercept traffic and control responses from an upstream server could
possibly use this issue to cause nginx to crash, resulting in a denial of
service. (CVE-2026-56434)
It was discovered that nginx incorrectly handled certain reque
Ubuntu
nginx regression
vendor_ubuntu·2026-07-20·CVSS 8.1
CVE-2026-42533 [HIGH] nginx regression
Title: nginx regression
Summary: USN-8563-1 introduced a regression in nginx
USN-8563-1 fixed vulnerabilities in nginx. One of the fixes introduced ABI
changes that could cause issues with external modules. This update reverts
the fix for CVE-2026-42533 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabl
Red Hat
nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
vendor_redhat·2026-07-15·CVSS 6.5
CVE-2026-56434 [MEDIUM] CWE-125 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).
Statement: This Moderate severity vulnerability in NGINX affects configurations utilizing the `ngx_http_ssi_module` alongside `proxy_pass` and `proxy_buffering off`. Exploitation requires an unauthenticated man-in-the-middle attacker to control upstream server responses, leading to limited memory modification or a worker process restart. The specific combination of directives and an active MITM position l
F5
CVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module
vendor_f5·2026-07-15·CVSS 6.5
CVE-2026-56434 [MEDIUM] CWE-416 CVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module
CVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure;
GHSA
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.
ghsa_unreviewed·2026-07-15
CVE-2026-56434 [HIGH] CWE-416 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Supp
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service [fedora-all]
bugzilla·2026-07-29·CVSS 6.5
CVE-2026-56434 [MEDIUM] CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service [fedora-all]
CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited mod
Bugzilla
CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
bugzilla·2026-07-15·CVSS 6.5
CVE-2026-56434 [MEDIUM] CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
CVE-2026-56434 nginx: NGINX: Heap buffer over-read allows memory modification or denial of service
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure
Hackernews
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
blogs_hackernews·2026-07-20·CVSS 5.9
CVE-2026-63030 [MEDIUM] ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.
The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.
Here is the full recap of what broke, what was exploited, and what needs attention now.
## ⚡ Threat of the Week
New wp2shell WordPress Core Flaw Lets Unauthe
2026-07-15
Published