F5 NGINX: Heap buffer overflow via alias, rewrite and $request_filename

Summary

A heap buffer overflow in the ngx_http_core_module of NGINX Open Source and NGINX Plus can be triggered by crafted HTTP requests. It only occurs when a location combines the alias directive with rewrite and a set or return directive referencing $request_filename, or when $request_filename is used in an access log format. A successful attack crashes the NGINX worker process (denial of service); on systems with ASLR disabled or weakened, code execution may be possible. No authentication is required, but the vulnerable configuration must be present.

Affected

• NGINX Open Source 1.31.0 to before 1.31.7
• NGINX Open Source 0.1.29 to before 1.30.6
• NGINX Plus 37.1.0 to before 37.1.0.1 and 37.0.0 to before 37.0.5.1 (per F5 record; older branches R33 to R36 affected, fixed builds unconfirmed)
• Other F5 and distribution packages: Unknown.

Fixed in

• NGINX Open Source 1.31.7 or later
• NGINX Open Source 1.30.6 or later
• NGINX Plus 37.1.0.1 or later and 37.0.5.1 or later (verify against F5 advisory K000162416)
• Other products and distributions: Unknown.

Workaround

• Avoid using the alias directive in a location block.
• Avoid using the $request_filename variable, including in access log formats.

Exploitation

• No known exploitation in the wild as of 26 Oct 2026; not listed in CISA KEV.
• CISA SSVC: Exploitation none, Automatable no, Technical impact total.
• A public proof-of-concept repository covers root cause and denial of service only; no RCE has been published.

Our recommendation

• Check all internet-facing NGINX, NGINX Plus, Ingress Controller and distribution packages and patch to the fixed versions.
• Search configurations for alias combined with rewrite, set, return or $request_filename, including log_format.
• If patching is delayed and the configuration is present, apply the workaround.
• Monitor for worker crashes and check the F5 advisory and NVD for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  FranklinF25/cve-2026-15176

Research sources

• F5 Advisory K000162416 my.f5.com
• nginx.org Security Advisories nginx.org
• CSA Singapore Alert AL-2026-150 www.csa.gov.sg
• Red Hat CVE Record access.redhat.com
• OpenCVE CVE-2026-15176 app.opencve.io
• OffSeq Threat Radar radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:34.