Loading vulnerability…
Heap buffer overflow in NGINX alias/rewrite request filename mapping
CVE-2026-15176 is a heap-based buffer overflow in the ngx_http_core_module of NGINX Plus and NGINX Open Source. Mapping a rewritten request URI to a filesystem path can overflow a heap buffer when a location combines alias and rewrite directives with a set or return directive referencing $request_filename. Referencing $request_filename in an access log_format directive provides an alternative trigger in the relevant configuration. An unauthenticated remote attacker can send crafted HTTP requests to trigger memory corruption, subject to additional conditions beyond the attacker's control. Exploitation can restart an NGINX worker process and potentially execute code if Address Space Layout Randomization (ASLR) is disabled or bypassed. The vulnerability affects only the data plane, with no control-plane exposure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash and restart NGINX worker processes, disrupting request processing and causing denial of service. If ASLR is disabled or bypassed, the heap overflow may permit arbitrary code execution within the worker process, potentially compromising the confidentiality and integrity of data accessible to that process. The control plane is not exposed by this vulnerability.
If you can’t patch tonight, do this now.
Avoid alias directives in location blocks and avoid use of $request_filename, including references in set, return, and access log_format directives, to eliminate the vulnerable configuration. Keep ASLR enabled to reduce code-execution risk; this does not prevent the overflow or denial of service and is not a substitute for patching. Run workers without elevated privileges, segment internet-facing deployments from sensitive systems, and monitor repeated worker restarts.
Patch, then assume compromise.
Install the applicable fixed release or a later security-fixed release: NGINX Open Source 1.30.6 stable or 1.31.7 mainline; NGINX Plus 37.0.5.1 or 37.1.0.1, according to branch; NGINX Instance Manager 2.24.0; F5 WAF for NGINX 5.14.2 or 5.16.0, according to branch; F5 DoS for NGINX 4.11.0; NGINX Gateway Fabric 2.8.0; or NGINX Ingress Controller 5.7.0. Migrate branches without a listed fix to a supported fixed release. For Debian 13 (trixie), upgrade nginx packages to 1.26.3-3+deb13u10 or a later Debian security-fixed version. Other distribution-managed installations should receive their applicable vendor security updates. Software beyond End of Technical Support was not evaluated.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.