CVE-2026-15176
published 2026-10-14CVE-2026-15176: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or…
PriorityP354high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.52%
43.1th percentile
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | nginx_open_source | >= 0.1.29 < 1.30.6 | 1.30.6 |
| f5 | nginx_open_source | >= 1.31.0 < 1.31.7 | 1.31.7 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= 37.0.0 < 37.0.5.1 | 37.0.5.1 |
| f5 | nginx_plus | >= 37.1.0 < 37.1.0.1 | 37.1.0.1 |
| f5 | nginx_plus | >= R33 < * | * |
| f5 | nginx_plus | >= R34 < * | * |
| f5 | nginx_plus | >= R35 < * | * |
| f5 | nginx_plus | >= R36 < * | * |
| php | php | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2026-15176: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directiv...
vendor_f5·2026-10-14·CVSS 8.1
CVE-2026-15176 [HIGH] CWE-122 CVE-2026-15176: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directiv...
CVE-2026-15176: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directiv...
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (AS
Red Hat
nginx: NGINX ngx_http_core_module vulnerability
vendor_redhat·2026-10-14·CVSS 8.1
CVE-2026-15176 [HIGH] CWE-787 nginx: NGINX ngx_http_core_module vulnerability
nginx: NGINX ngx_http_core_module vulnerability
A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing worker processes.
Package: nginx (Red Hat Hardened Images) - Affected
Package: php (Red Hat Hardened Images) - Affected
GHSA
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_file
ghsa_unreviewed·2026-10-14
CVE-2026-15176 [CRITICAL] CWE-122 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_file
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (Do
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-44]
bugzilla·2026-10-19·CVSS 8.1
CVE-2026-15176 [HIGH] CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-44]
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit thi
Bugzilla
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-43]
bugzilla·2026-10-19·CVSS 8.1
CVE-2026-15176 [HIGH] CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-43]
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit thi
Bugzilla
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename
bugzilla·2026-10-14·CVSS 8.1
CVE-2026-15176 [HIGH] CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename
CVE-2026-15176 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR)
Hackernews
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
blogs_hackernews·2026-10-19
CVE-2026-102764 ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.
This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.
Some attacks were cleve
2026-10-14
Published