Cloudanix VulnDB

CVE-2026-56434

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Jul 15, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain NGINX setups could let someone who can intercept network traffic cause the web server to restart or make small unauthorized changes in memory.

Chainable
Exploitation
Adjacent Network
Attacker needs
Other
Complexity
Moderate
Impact
Data Tampering
Component
Network Service
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free in the NGINX worker process when ngx_http_ssi_module processes responses under SSI + proxy_pass + proxy_buffering off configuration, allowing limited memory modification or worker restart.

Why it matters to the business

Potential intermittent disruption to web traffic handling and limited unauthorized memory changes in affected NGINX instances; urgency is moderate given low EPSS and no known active exploitation or ransomware use, though downstream package prevalence increases exposure surface for organizations relying on the redhat nginx-main package.

How an attack unfolds

An attacker positioned as a MITM intercepts traffic to an upstream server, crafts malicious responses, and delivers them when the vulnerable NGINX configuration (SSI enabled with proxy_pass and buffering disabled) processes the data, triggering the use-after-free condition in the worker process.

How to fix it

Upgrade nginx-main on redhat to version 1.30.4-2.hum1 (RHSA-2026:46012) or later; disable the vulnerable SSI + proxy_pass + proxy_buffering off combination if immediate patching is not feasible.

How to confirm the fix worked

Verify installed package version meets or exceeds the fixed release; audit nginx configuration for the specific directive combination and test with controlled upstream responses after upgrade.

Typical attack path

  1. Position as MITM to control upstream HTTP responses
  2. Trigger client requests that cause NGINX to fetch and process upstream content via proxy_pass with SSI active and buffering off
  3. Deliver specially crafted response that induces use-after-free during SSI parsing
  4. Observe or leverage resulting memory modification or worker process restart

How to detect it

Inspect NGINX worker process crash logs and memory error reports for use-after-free patterns during SSI response handling; correlate with MITM-susceptible upstream traffic.

What your security team should do

  • Apply the fixed package version immediately on all affected redhat nginx-main deployments
  • Review and restrict use of SSI with proxy_pass where proxy_buffering is disabled
  • Monitor for worker process restarts correlating with upstream traffic patterns
  • Track EPSS and KEV updates for any change in exploitation likelihood

The record

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities