Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by f5

CVE-2026-15176NGINX ngx_http_core_module vulnerability

High 8.1

In plain English

A high-severity heap buffer overflow in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24nginx1.30.6-r0ALPINE-CVE-2026-15176
Debian:12nginxno fix listedDEBIAN-CVE-2026-15176
Debian:13nginx1.26.3-3+deb13u10DEBIAN-CVE-2026-15176
Debian:14nginx1.30.4-8DEBIAN-CVE-2026-15176
Ubuntu:22.04:LTSnginx1.18.0-6ubuntu14.22USN-8955-1
Ubuntu:22.04:LTSnginx1.18.0-6ubuntu14.22UBUNTU-CVE-2026-15176
Ubuntu:24.04:LTSnginx1.24.0-2ubuntu7.19USN-8955-1
Ubuntu:24.04:LTSnginx1.24.0-2ubuntu7.19UBUNTU-CVE-2026-15176
Ubuntu:26.04:LTSnginx1.28.3-2ubuntu1.12UBUNTU-CVE-2026-15176
Ubuntu:26.04:LTSnginx1.28.3-2ubuntu1.12USN-8955-1
Ubuntu:26.10nginx1.30.4-7ubuntu1.1USN-8955-1
Ubuntu:26.10nginx1.30.4-7ubuntu1.1UBUNTU-CVE-2026-15176

Affected products (as reported)

VendorProductVersions
F5 NGINX Plus 37.1.0 – before 37.1.0.137.0.0 – before 37.0.5.1R36 – before *R35 – before *R34 – before *R33 – before *
F5 NGINX Open Source 1.31.0 – before 1.31.70.1.29 – before 1.30.6

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References