CVE-2026-15176

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in NGINX Plus and NGINX Open Source

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-15176

EUVD

EUVD-2026-101112

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Plus 37.1.0
F5	NGINX	Plus 37.0.0
F5	NGINX	Plus R36
F5	NGINX	Plus R35
F5	NGINX	Plus R34
F5	NGINX	Plus R33
F5	NGINX	Open Source 1.31.0
F5	NGINX	Open Source 0.1.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured using the alias directive with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, it can occur if $request_filename is used in an access log format directive. An attacker can exploit this by sending crafted HTTP requests to cause a heap buffer overflow in the NGINX worker process, leading to a restart or code execution if ASLR is disabled or bypassed.

Detection Guidance

To detect this vulnerability, inspect NGINX configuration files for locations using the alias directive combined with rewrite or set/return directives referencing $request_filename. Check access log formats for $request_filename usage. Monitor for unexpected worker process restarts or crashes.

Impact Analysis

This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or possibly execute code. It does not affect the control plane, only the data plane, meaning it impacts web traffic handling and server availability.

Compliance Impact

This vulnerability primarily causes denial-of-service or potential code execution on NGINX systems. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, a DoS condition could disrupt services handling regulated data, indirectly affecting compliance by causing downtime or data unavailability.

Mitigation Strategies

Immediately update NGINX Plus and NGINX Open Source to patched versions. Remove or modify configurations using alias with rewrite or $request_filename in access logs. Enable ASLR if disabled. Monitor for exploitation attempts and restart worker processes if crashes occur.

Hi! I’m here to help you understand CVE-2026-15176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70