Nginx use-after-free CVE-2026-97205 in AIO: affected versions and upgrades

CVE-2026-97205 Nginx

Nginx is affected by use-after-free CVE-2026-97205 when asynchronous file I/O (AIO) is used. Versions 0.8.11–1.31.6 are affected; check the installed version and upgrade to 1.31.7+ or 1.30.6+.

Nginx use-after-free CVE-2026-97205 in AIO: affected versions and upgrades

At a glance
Nginx has use-after-free CVE-2026-97205 when asynchronous file I/O (AIO) is used.
Nginx 0.8.11–1.31.6 is affected; 1.31.7+ and 1.30.6+ are unaffected.
The vulnerability may lead to unsafe behavior in Nginx.
Check the version and upgrade to an appropriate fixed branch.

In this article

Nginx Security reported CVE-2026-97205, a use-after-free vulnerability associated with using AIO in Nginx. Administrators can compare the running version with the affected range and fixed-version thresholds in the Nginx security advisory.

Overview and technical details

Field	Details
Product	Nginx
Vulnerability ID	CVE-2026-97205
Vulnerability type	Use-after-free
Severity	Medium
Source	Nginx Security

The vulnerability occurs when using asynchronous file I/O (AIO), a feature that enables asynchronous file I/O processing. The reported impact is that it may lead to unsafe behavior in Nginx.

Affected systems

Product	Affected versions	Unaffected versions
Nginx	0.8.11–1.31.6	1.31.7+ or 1.30.6+

Compare the system version with the fixed branch in use. The 1.31.7+ and 1.30.6+ thresholds are identified as unaffected branches.

System checks

Check the installed Nginx version with these commands:
```
nginx -v
nginx -V
```
If the version is within 0.8.11–1.31.6, upgrade to 1.31.7+ or 1.30.6+.

Remediation and mitigation

Upgrade Nginx to version 1.31.7+ or 1.30.6+, as appropriate for the branch in use.
Prioritize upgrading affected versions to an appropriate fixed branch during an early maintenance window.