CVE-2026-15176

A heap buffer overflow (CWE-122) exists in NGINX Plus and NGINX Open Source when a location uses the alias directive together with rewrite and a set or return directive that references $request_filename, or when $request_filename is used in an access-log format. An unauthenticated remote attacker can send crafted HTTP requests, but only if those configuration conditions are already present, and overflow a buffer in the NGINX worker process. The worker can crash and restart, causing a denial of service, and code execution may be possible on systems where ASLR is disabled or can be bypassed; this is a data-plane issue only, with no control-plane exposure. Exact affected version ranges are not stated in the provided advisory data, and End-of-Technical-Support releases were not evaluated. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the vendor's fixed NGINX Open Source and NGINX Plus builds as soon as they are available for your supported release, and treat End-of-Technical-Support releases as unassessed. Until then, review location blocks that combine alias with rewrite and set or return using $request_filename, and access_log formats that reference $request_filename, and remove or change those patterns. Keep ASLR enabled and watch worker processes for unexpected restarts.