CVE-2026-15176

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description An issue exists when a location is configured using the alias directive combined with rewrite and a set or return directive that references the $request filename variable. This can also occur if the $request filename variable is used within an access log format directive. An unauthenticated attacker can send crafted HTTP requests to trigger a heap buffer overflow in the NGINX worker process, resulting in a process restart. This may lead to a denial-of-service (DoS) or potential remote code execution on systems where Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas—is disabled or bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.