# CVE-2026-56434: F5 NGINX heap buffer over-read in ngx_http_ssi_module

Source: https://junglewise.ai/threats/cve-2026-56434-f5-nginx-heap-buffer-over-read-in-ngx-http-ssi-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-56434 · Severity: medium · CVSS 6.5 · Published 2026-07-15

NGINX Plus and NGINX Open Source are widely used web server and proxy solutions. A vulnerability in the Server-Side Includes (SSI) module could allow an attacker with the ability to intercept network traffic to crash the NGINX worker process or cause limited memory corruption. This could lead to service interruptions or instability in the web server's operations.

Technologies: [F5 Nginx Plus](https://junglewise.ai/threats/technologies/nginx-plus). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-56434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56434 being exploited in the wild.

**How severe is CVE-2026-56434?** Medium severity, with a CVSS score of 6.5, published 15 July 2026.

**Which products and versions are affected?** F5 Nginx Plus 37.0.0.1 to 37.0.3.1, R36 to R36 P7, R33 and later.

**Is there a fix for CVE-2026-56434?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56434 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-56434?** Check whether you run F5 Nginx Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer over-read vulnerability (CWE-416/Use After Free) exists in the ngx_http_ssi_module of NGINX. The issue is triggered when Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are simultaneously configured. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can control responses from an upstream server to trigger the flaw. Successful exploitation can lead to a restart of the NGINX worker process (DoS) or limited modification of memory. The vulnerability is restricted to the data plane and does not expose the control plane.

## Affected products

- F5 NGINX Plus 37.0.0.1 to 37.0.3.1, R36 to R36 P7, R33 and later
- F5 NGINX Open Source 1.31.2 to 1.31.3, 0.8.11 to 1.30.4

## Timeline

- 2026-07-15: advisory: Initial publication of the advisory by F5 and NVD.

## References

- [https://my.f5.com/manage/s/article/K000162098](https://my.f5.com/manage/s/article/K000162098)

## Related threats

- [NGINX uninitialized memory access in ngx_http_slice_module](https://junglewise.ai/threats/cve-2026-60005-nginx-uninitialized-memory-access-in-ngx-http-slice-module)
- [F5 NGINX Plus heap buffer over-read in MQTT filter module](https://junglewise.ai/threats/cve-2026-60065-f5-nginx-plus-heap-buffer-over-read-in-mqtt-filter-module)
- [F5 NGINX heap buffer overflow in map directive](https://junglewise.ai/threats/cve-2026-42533-f5-nginx-heap-buffer-overflow-in-map-directive)
- [F5 NGINX heap buffer over-read in ngx_http_charset_module](https://junglewise.ai/threats/cve-2026-48142-f5-nginx-heap-buffer-over-read-in-ngx-http-charset-module)
- [NGINX heap buffer overflow in HTTP/2 and gRPC proxy modules](https://junglewise.ai/threats/cve-2026-42055-nginx-heap-buffer-overflow-in-http-2-and-grpc-proxy-modules)