Open source nginx before 1.31.7 or 1.30.6 may allow RCE
Original title: nginx RCEs CVE-2026-93479, CVE-2026-15176
An oss-security post says at least two F5-published nginx issues may allow remote code execution.
Jan Schaumann pointed oss-security readers to an F5 advisory and the nginx security advisories page. He says the issues appear to affect open source nginx before 1.31.7 or 1.30.6, and that at least two include a possibility of remote code execution. The post does not describe exploitation or give further technical detail.
Unconfirmed: The poster says the issues appear to affect those versions and that at least two may allow RCE.
- F5 advisory K000163408 and nginx.org advisories are cited.
- Affected range given is open source nginx prior to 1.31.7 or 1.30.6.
- The poster says at least two issues include possible RCE.
Impact: possible remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| F5 nginx | open source nginx prior to 1.31.7 or 1.30.6 | 1.31.7 or 1.30.6 |
- 1.Upgrade open source nginx to 1.31.7 or 1.30.6
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+1 related CVE | NGINX heap overflow via alias and $request_filename | 9.2 | — |
From the original article
Posted by Jan Schaumann on Oct 23 F5 has published a security advisory: https://my. f5. com/manage/s/article/K000163408 https://nginx.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.