Quick answers
- Is CVE-2026-15176 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15176 being exploited in the wild.
- How severe is CVE-2026-15176?
- High severity, with a CVSS score of 8.1, published 14 October 2026.
- Which products and versions are affected?
- NGINX Open Source <UNKNOWN>; NGINX Plus <UNKNOWN>.
- Is there a fix for CVE-2026-15176?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-15176 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-15176?
- Check whether you run NGINX Open Source or NGINX Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer overflow exists when a location is configured with the alias directive combined with rewrite, set, or return directives that reference the $request_filename variable, or when $request_filename is used in access log format directives. An unauthenticated attacker can exploit this via crafted HTTP requests without authentication required, leading to worker process crashes or code execution when ASLR is disabled or bypassed.
Affected products
- NGINX NGINX Plus <UNKNOWN>
- NGINX NGINX Open Source <UNKNOWN>
Timeline
- 2026-10-14: disclosed