# CVE-2026-15176: NGINX Plus and Open Source heap buffer overflow in alias directive with rewrite

Source: https://junglewise.ai/threats/cve-2026-15176-a-vulnerability-exists-in-nginx-plus-and-nginx-open-source-when-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-15176 · Severity: high · CVSS 8.1 · Published 2026-10-14

NGINX Plus and Open Source, web servers used to host websites and applications, contain a vulnerability in configurations using the alias directive with rewrite rules. An attacker can send specially crafted requests to cause a crash (denial of service) or potentially execute code on systems where ASLR is disabled, compromising the availability and integrity of the web server.

Technologies: [NGINX Open Source](https://junglewise.ai/threats/technologies/open-source). Vendors: [NGINX](https://junglewise.ai/threats/vendors/nginx).

## Quick answers

**Is CVE-2026-15176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15176 being exploited in the wild.

**How severe is CVE-2026-15176?** High severity, with a CVSS score of 8.1, published 14 October 2026.

**Which products and versions are affected?** NGINX Open Source <UNKNOWN>; NGINX Plus <UNKNOWN>.

**Is there a fix for CVE-2026-15176?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15176 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15176?** Check whether you run NGINX Open Source or NGINX Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists when a location is configured with the alias directive combined with rewrite, set, or return directives that reference the $request_filename variable, or when $request_filename is used in access log format directives. An unauthenticated attacker can exploit this via crafted HTTP requests without authentication required, leading to worker process crashes or code execution when ASLR is disabled or bypassed.

## Affected products

- NGINX NGINX Plus <UNKNOWN>
- NGINX NGINX Open Source <UNKNOWN>

## Timeline

- 2026-10-14: disclosed

## References

- [https://my.f5.com/manage/s/article/K000162416](https://my.f5.com/manage/s/article/K000162416)

## Related threats

- [NGINX Plus and Open Source HTTP/3 heap buffer overflow in TLS handshake](https://junglewise.ai/threats/cve-2026-90439-nginx-plus-and-open-source-http-3-heap-buffer-overflow-in-tls)
- [F5 NGINX heap buffer over-read in ngx_http_charset_module](https://junglewise.ai/threats/cve-2026-42934-f5-nginx-heap-buffer-over-read-in-ngx-http-charset-module)
- [F5 NGINX Open Source header injection in HTTP/2 proxying](https://junglewise.ai/threats/cve-2026-42926-f5-nginx-open-source-header-injection-in-http-2-proxying)
- [F5 NGINX heap-use-after-free in ngx_http_ssl_module](https://junglewise.ai/threats/cve-2026-40701-f5-nginx-heap-use-after-free-in-ngx-http-ssl-module)
- [F5 NGINX IP address spoofing in HTTP/3 QUIC module](https://junglewise.ai/threats/cve-2026-40460-f5-nginx-ip-address-spoofing-in-http-3-quic-module)