Critical NGINX flaw can crash servers and, in some cases, allow code execution

What happened

CVE-2026-15176 was published in NVD on 14 October 2026 with a CVSS score of 9.2 (critical). It is a heap buffer overflow in the NGINX worker process that a remote, unauthenticated attacker can trigger by sending crafted HTTP requests.

The most immediate effect is that the worker process restarts, which can lead to a denial of service. In addition, if Address Space Layout Randomization (ASLR) is disabled on the system, or if the attacker manages to bypass it, they may be able to execute code on the server.

Who is affected

According to the published description, the flaw affects NGINX Plus and NGINX Open Source, but only when the configuration meets specific conditions. The available data does not state which versions are affected or which ones fix the issue, and versions that have reached End of Technical Support have not been evaluated.

The issue arises in these cases:

• A location block that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable.
• An access log format (log_format) that includes the $request_filename variable.
• Only the data plane (the traffic NGINX processes) is affected; there is no control plane exposure.

Exploitation status

There is no confirmed active exploitation at this stage: the vulnerability is not listed in CISA's KEV catalogue. Exploitation is rated as highly complex, since it depends on conditions outside the attacker's control, but that does not lessen the potential impact on servers running the vulnerable configuration.

What to do

Based on the data available to us, the vendor has not yet detailed which versions contain the fix. We recommend working on configuration and updates in parallel:

• Inventory all servers running NGINX Plus or NGINX Open Source, starting with those exposed to the internet.
• Search configurations for the $request_filename variable, both in location blocks combining alias, rewrite and set or return, and in log_format directives.
• Where that combination is in use, consider removing or replacing it temporarily until a fix can be applied.
• Make sure ASLR is enabled on the operating systems running NGINX, as it greatly reduces the chance of code execution.
• Monitor F5's security advisories for NGINX and apply the update as soon as it is released.
• Watch for unexpected NGINX worker process restarts, which could signal exploitation attempts.

Affected technologies

Vulnerabilities (1)