NGINX HTTP/3 use-after-free in ngx_http_v3_module
Use-after-free in NGINX's HTTP/3 module. Can crash worker processes; code execution is possible when ASLR is disabled. Configurations using AIO or SSI are at higher risk.
- Vendor
- F5
- Product
- NGINX (Plus, Open Source, Ingress Controller, Gateway Fabric, Instance Manager)
- CVSS
- 8.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-97205 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-97205 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
CVE-2026-97205 is a use-after-free vulnerability in ngx_http_v3_module. Exploitation can cause NGINX worker processes to crash or restart; code execution is possible on systems where ASLR is disabled.
Configurations running asynchronous file I/O (AIO) or Server Side Includes (SSI) have a larger attack surface. F5’s recommended workaround for deployments that cannot patch immediately: disable AIO and SSI.
F5 issued out-of-band patches on October 19, 2026 across NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager. NVD rates this CVSS 8.1 (high). No active exploitation has been confirmed. This is one of two memory-safety issues found in the same HTTP/3 module in this advisory cycle; see also CVE-2026-15176.
Other F5 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93479 NGINX map directive use-after-free and buffer overflowwrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-15176 NGINX HTTP/3 heap buffer overflow in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 2.2% | |
| CVE-2026-42533 nginx map directive regex-capture heap buffer overflow in workerwrite-up | [ HIGH ] | 8.1 | 0.9% | — |
| CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 2.3% | |
| CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability | [ HIGH ] | 8.8 | 4.5% | |
| CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.5% | |
| CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
