CVE-2026-15176
NGINX alias with rewrite heap buffer overflow in worker process
F5 fixed a heap buffer overflow when alias is combined with rewrite and $request_filename in NGINX Plus and NGINX Open Source. F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates it medium. An unauthenticated attacker can crash a worker, or run code if ASLR is off or bypassed. Specific configuration required. Fixed in OSS 1.31.7 and 1.30.6 and Plus 37.1.0.1 and 37.0.5.1. Not in CISA KEV.
- CVSS
- 9.2
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- F5
- Products
- NGINX Plus, NGINX Open Source
- Affected
- NGINX Plus 37.1.0 before 37.1.0.1, 37.0.0 before 37.0.5.1, and R33 to R36. NGINX Open Source 1.31.0 before 1.31.7 and up to 1.30.5 per F5. nginx.org lists 0.1.29 to 1.31.6 as vulnerable. Only specific configurations are exposed.
- Fixed
- NGINX Open Source 1.31.7 (mainline) and 1.30.6 (stable), and NGINX Plus 37.1.0.1 and 37.0.5.1, released 14 October 2026. F5 lists no fix for Plus R33 to R36.
- CWE
- CWE-122
- Published
- 14 Oct 2026
- Updated
- 14 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-15176 is a heap buffer overflow when alias is combined with rewrite and $request_filename in NGINX Plus and NGINX Open Source. F5 published its advisory on 14 October 2026. The weakness is CWE-122.
It needs a location using alias together with rewrite, plus a set or return directive that references the request_filename variable. Using that variable in an access log format can also trigger it. Default configurations are not described as affected.
F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates the same issue medium. NVD shows the F5 scores and is awaiting analysis.
An unauthenticated attacker can send crafted HTTP requests and crash the worker process. F5 says code execution is possible when ASLR is disabled or can be bypassed. F5 says this is a data plane issue with no control plane exposure.
Fixed versions are NGINX Open Source 1.31.7 and 1.30.6, and NGINX Plus 37.1.0.1 and 37.0.5.1. F5 lists Plus R33 to R36 as affected with no fix. F5 lists itself as the finder.
The CVE is not in the CISA KEV catalog. ThreatWire found no report of exploitation and no public PoC.