Remote Code Execution Vulnerability in NGINX Plus and NGINX Open Source
CVE-2026-15176

9.2CRITICAL

Key Information:

Vendor

F5
Status
Nginx Plus
Nginx Open Source
Vendor
CVE Published:
14 October 2026

What is CVE-2026-15176?

A vulnerability in NGINX Plus and NGINX Open Source occurs when the alias directive is improperly configured, allowing an unauthenticated attacker to exploit the system by sending specially crafted HTTP requests. This can lead to a heap buffer overflow in the NGINX worker process, potentially causing a system reboot. Additionally, if Address Space Layout Randomization (ASLR) is disabled, attackers could execute arbitrary code, resulting in denial of service or further exploitation. Security measures must be reinforced to prevent unauthorized access.

Affected Version(s)

NGINX Open Source 1.31.0 < 1.31.7

NGINX Open Source 0.1.29 < 1.30.6

NGINX Plus 37.1.0 < 37.1.0.1

References

https://my.f5.com/manage/s/article/K000162416
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.