CVE-2026-15176
CRITICAL 9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severe if exploited (CVSS 9.2), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.8%chance of exploitation in 30 days · 58th percentile
Impact if exploited
9.2CVSS 4.0 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-122: Heap-based Buffer Overflow
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 102 vendor product statements; 70 omitted. Read the full vendor advisory.
nginx-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-0:1.30.6-1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-all-modules-0:1.30.6-1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-core-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-devel-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-http-geoip-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-http-image-filter-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-http-perl-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-http-perl-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-http-xslt-filter-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-mail-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-stream-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-stream-geoip-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx-mod-stream-geoip-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nginx as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-stream as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-stream
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-filesystem as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-filesystem
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-http-image-filter as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-image-filter
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-http-xslt-filter as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-xslt-filter
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-stream (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-stream?rpmmod=nginx:1.24
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-all-modules as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-all-modules
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-core (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-core?rpmmod=nginx:1.24
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-filesystem (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-filesystem?rpmmod=nginx:1.26
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-http-image-filter (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-image-filter?rpmmod=nginx:1.24
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-http-xslt-filter as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-xslt-filter
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-mail (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-mail?rpmmod=nginx:1.24
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx-mod-stream (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-stream?rpmmod=nginx:1.26
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
nginx (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx?rpmmod=nginx:1.26
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Affected
php.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
All CVSS metrics
- HIGH 8.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.2 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CRITICAL 9.2 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://my.f5.com/manage/s/article/K000162416 CVE record · f5 · Updated 2026-10-14T14:40:26.374Z
NVD · CVE-2026-15176 · Updated 2026-10-15T11:17:28.110
Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15176.json Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101112 EUVD · EUVD-2026-101112
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-15176 Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2552352 Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-15176 Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-15176 Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00
- https://access.redhat.com/errata/RHSA-2026:83427 Red Hat · CVE-2026-15176 · Updated 2026-10-19T10:49:12+00:00