CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

NGINX Open Source and NGINX Plus alias/rewrite/$request_filename heap buffer overflow (CVSS 4.0 9.2, F5), unauthenticated, configuration-dependent; fixed in 1.30.6 and 1.31.7

cve · CVE-2026-15176

Coverage
1
first 2026-10-20 → last 2026-10-20
Latest activity
2026-10-20
Three configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6 and 1.31.7; Debian stable is…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
6
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-15176, newest first. Check the date before acting on an older one.

  • Run nginx -T on every internet-facing NGINX reverse proxy, load balancer and ingress and upgrade each one whose configuration uses alias with rewrite and $request_filename, a regex map whose captures are referenced before its output variable, or aio together with ssi, HTTP/3 or TLS session ticket key rotation to nginx 1.30.6 or 1.31.7 (NGINX Plus 37.0.5.1 or 37.1.0.1); where the package comes from Debian bookworm or trixie, which the tracker still marks vulnerable, apply F5's configuration workaround until the distribution ships a fix.
    2026-10-20CVE-2026-15176 +4

Defender insights

What each entry about CVE-2026-15176 tells a defender to do, newest first.

2026-10-20NOTABLEThree configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6 and 1.31.7; Debian stable is not yet

Exposure · detection

Story timeline

  1. 2026-10-20CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7
    trending-vulnerabilitiesThree configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6 and 1.31.7; Debian stable is not yet

Hunting pivots

Affected products
F5 NGINX Open SourceF5 NGINX Plus
Tags
dospatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ImpactEndpoint Denial of Service: Application or System Exploitation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-20/nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6 · ATT&CK page ↗

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-10-20/nginx-three-unauth-heap-corruption-flaws-fixed-1-30-6 · ATT&CK page ↗

Entries about NGINX Open Source and NGINX Plus alias/rewrite/$request_filename heap buffer overflow (CVSS 4.0 9.2, F5), unauthenticated, configuration-dependent; fixed in 1.30.6 and 1.31.7 (1)

2026-10-20 · view entry permalink →

NOTABLECVE-2026-15176 +4NATOA2

CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7

nginx's change log for 1.30.6, dated 14 October 2026, lists five security fixes, which nginx.org's advisories page ties to 1.30.6 (stable) and 1.31.7 (mainline) (nginx.org change log, 2026-10-14; nginx.org, 2026-10-14); three of them are CVE-2026-15176, a heap buffer overflow in the core module that CCB describes as reachable where a location uses alias together with rewrite and a set or return directive referencing $request_filename, or where $request_filename appears in an access-log format; CVE-2026-93479, a heap buffer overflow in script evaluation that affects configurations whose regex map captures are referenced in root or an access-log format before the map's output variable, or that use a non-cacheable variable in a string expression; and CVE-2026-97205, a use-after-free when asynchronous file I/O is enabled, which Daily CyberSecurity relays from F5 as triggered by an SSI page with include virtual commands (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). Each is scored CVSS 4.0 9.2 and reachable by an unauthenticated network attacker, the first two under conditions beyond the attacker's control, with CCB's warning and vector covering the first two and Daily CyberSecurity all three (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). F5's CNA text says the overflow may restart the worker process and that attackers can execute code where ASLR is disabled or can be bypassed (Debian Security Tracker, 2026-10-20). Daily CyberSecurity reports that F5 has confirmed no public proof of concept for any of the three, and no exploitation is reported (Daily CyberSecurity, 2026-10-14). Help Net Security reports that VulnCheck flagged exploitation attempts against an earlier NGINX flaw, CVE-2026-42945, three days after the flaw and its proof of concept were public (Help Net Security, 2026-05-18). The other two are CVE-2026-95101 (with HTTP/3, part of an unknown frame might be treated as the request body, bypassing client_max_body_size or injecting data into the proxied request) and CVE-2026-97629 (with TLS session ticket key rotation, one key was left uninitialised, which might allow forging a session) (nginx.org change log, 2026-10-14); nginx.org rates all five medium (nginx.org, 2026-10-14).

Security: when using TLS session ticket key rotation, one of the keys

nginx.org (change log for nginx 1.30.6) 2026-10-14

Not vulnerable: 1.31.7+, 1.30.6+

Use-after-free when using asynchronous file I/O (AIO)

nginx.org (security advisories) 2026-10-14

CVE-2026-93479: CVSS 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, an attacker could also execute code

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

Centre for Cybersecurity Belgium (CCB) 2026-10-19

when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing

F5 (CNA text for CVE-2026-15176, as republished by the Debian Security Tracker)

Currently, F5 has confirmed no public proof-of-concept exploit code for any of the three flaws.

Daily CyberSecurity 2026-10-14

A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers

Help Net Security 2026-05-18

Builds on: F5 out-of-band patches a 15-year-old pre-auth heap overflow in nginx's script engine; credited… · CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in… · CVE-2026-42530 / CVE-2026-42055, NGINX: HTTP/3 QUIC use-after-free and HTTP/2-proxy heap…

vulnerability20 Oct 03:55Zmulti-sourceOpen finding →
Sources: nginx.org (change log for nginx 1.30.6) · nginx.org (security advisories) · Centre for Cybersecurity Belgium (CCB) · Debian Security Tracker · Daily CyberSecurity · Help Net Security

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • nginx.org2 (33%)
  • ccb.belgium.be1 (17%)
  • helpnetsecurity.com1 (17%)
  • security-tracker.debian.org1 (17%)
  • securityonline.info1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)