CVE-2026-97205: An 8-Bit Counter and 256 Pending AIO Operations

The NGINX use-after-free fixed in 1.30.6 and 1.31.7 is a textbook case of a counter that needed a bound and never got one. CVE-2026-97205 requires aio enabled together with SSI pages that use include virtual commands, and its root cause is a single byte.

The mechanism

When aio is on, file operations for a request become asynchronous. Each pending asynchronous operation on that request increments a counter in the request structure. That counter is eight bits wide, and nothing checks it before incrementing.

At 256 pending operations the counter wraps to zero. Once the counter reads zero, NGINX concludes that no asynchronous work remains for the request and is free to release it. The operations themselves are still outstanding, and they still hold pointers into the memory that was just returned to the pool.…