CVE-2026-97205 — NGINX ngx_http_core_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. In certain configurations where asynchronous file I/O (AIO) is enabled, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.