Quick answers
- Is CVE-2026-56434 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56434 being exploited in the wild.
- How severe is CVE-2026-56434?
- Medium severity, with a CVSS score of 6.5, published 15 July 2026.
- Which products and versions are affected?
- F5 Nginx Plus 37.0.0.1 to 37.0.3.1, R36 to R36 P7, R33 and later.
- Is there a fix for CVE-2026-56434?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-56434 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-56434?
- Check whether you run F5 Nginx Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer over-read vulnerability (CWE-416/Use After Free) exists in the ngx_http_ssi_module of NGINX. The issue is triggered when Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are simultaneously configured. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can control responses from an upstream server to trigger the flaw. Successful exploitation can lead to a restart of the NGINX worker process (DoS) or limited modification of memory. The vulnerability is restricted to the data plane and does not expose the control plane.
Affected products
- F5 NGINX Plus 37.0.0.1 to 37.0.3.1, R36 to R36 P7, R33 and later
- F5 NGINX Open Source 1.31.2 to 1.31.3, 0.8.11 to 1.30.4
Timeline
- 2026-07-15: advisory: Initial publication of the advisory by F5 and NVD.