F5’s 14 October 2026 security advisory fixes CVE-2026-15176, a critical heap-buffer-overflow in NGINX’s ngx_http_core_module. The vulnerability is rated CVSS v4.0 9.2 (Critical) and can let an unauthenticated HTTP client crash NGINX workers; code execution is possible when address-space layout randomization (ASLR) is disabled or bypassed. The affected configuration combines alias and rewrite directives and references $request_filename, including when that variable is used in an access-log format.
What CVE-2026-15176 does
An attacker does not need an account to send specially crafted HTTP requests. On a server using the vulnerable alias plus rewrite pattern, NGINX can read or write beyond an allocated heap buffer while processing the request. The immediate consequence can be a worker restart or denial of service. F5’s advisory says the same flaw may also permit code execution; that outcome depends on defeating memory protections such as ASLR, so it is not guaranteed on every installation.
As an Amazon Associate I earn from qualifying purchases.
F5 lists the issue as both CVSS v4.0 9.2 Critical and CVSS v3.1 8.1 High. F5’s wording is direct: “This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution.” No affected-installation count or loss estimate has been published in the authoritative advisories cited for this issue.
Check your product and upgrade to a fixed branch
Use the exact product and version running in production, including container images and managed control-plane components. The following ranges and fixes come from F5’s evaluated-products table.
#1 Best Overall
| Product branch | Vulnerable versions | First listed fixed version | What to check |
|---|---|---|---|
| NGINX Open Source | 1.0.0–1.30.5 and 1.31.0–1.31.6 | 1.30.6 or 1.31.7 | Locations using alias with rewrite and $request_filename; also inspect access-log formats. |
| NGINX Plus | 37.0.0–37.0.4 | 37.0.5.1 or 37.1.0.1 | The same core-module request path and logging variable. |
| NGINX Instance Manager | 2.18.0–2.23.0 | 2.24.0 | Upgrade the manager as well as the managed NGINX data-plane instances. |
| F5 WAF for NGINX | 5.9.0–5.15.0 | 5.16.0 or 5.14.2 | Do not assume the WAF layer removes exposure in the underlying NGINX worker. |
| F5 DoS for NGINX | 4.8.0–4.10.0 | 4.11.0 | Check the packaged NGINX version and the product module together. |
| NGINX Gateway Fabric | 2.1.0–2.7.2 | 2.8.0 | Review gateway-managed HTTP routes for the affected directives. |
| NGINX Ingress Controller | 5.6.0–5.6.3 | 5.7.0 | Inspect generated NGINX configuration, not only the controller image tag. |
F5 lists no update candidate in the cited table for its App Protect WAF and App Protect DoS branches. Operators should move to a fixed, supported branch when that is operationally possible rather than treating those products as permanently exempt.
How to determine whether your configuration is exposed
- Inventory every deployment. Record the NGINX Open Source or Plus version, product add-ons, container digest, operating system package, and whether the instance is behind an ingress or gateway controller.
- Search the active configuration. Look for locations containing both
aliasandrewrite, then identify uses of$request_filename. Checklog_formatdeclarations too, because F5 says the variable’s presence in an access-log format can satisfy the condition. - Compare with F5’s version boundaries. A configuration is not made safe merely by being difficult to reach internally; an unauthenticated client that can reach the HTTP listener may be able to trigger it.
- Preserve evidence before restarting. Save error logs, worker-exit messages, request logs, configuration snapshots and container metadata. Unexpected worker restarts or repeated crashes after unusual requests should be treated as a possible exploitation signal.
What to do if an upgrade cannot happen immediately
F5’s mitigation guidance is to remove or redesign the vulnerable alias plus rewrite locations that reference $request_filename. A practical emergency change is to serve the required path with a safer, explicit mapping that does not combine those directives, and to remove the variable from access-log formats where it is not essential. Validate the resulting configuration with nginx -t before a reload, then test the affected URLs from a staging or controlled client.
Do not rely on a web-application firewall rule as a complete fix: the flaw is in NGINX request processing, and a crafted request may reach the worker before an application-layer policy can help. Restricting exposure at a load balancer, firewall or private network boundary can reduce who can send requests while the patch is scheduled, but it does not remove the defect. Keep detailed logs and monitor worker restarts during the mitigation window.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Other 2026 NGINX vulnerabilities require a parallel review
F5’s advisory is part of a broader set of NGINX security notices published in 2026. The NGINX advisory index includes memory-safety and protocol issues involving HTTP/3, the rewrite module, proxy and HTTP/2 buffering, and gRPC handling. Those issues have their own affected ranges and fixed-version boundaries, so upgrading only for CVE-2026-15176 may not address every risk in a deployment.
HTTP/3 use-after-free
Singapore’s Cyber Security Agency describes CVE-2026-42530 as an unauthenticated HTTP/3 use-after-free that can crash workers and may permit code execution when ASLR is disabled or bypassed. If HTTP/3 is enabled, include it in the same configuration and patch review.
Rewrite and heap overflows
CSA identifies CVE-2026-42055 as a heap-based buffer overflow and CVE-2026-42945 as a heap buffer overflow in ngx_http_rewrite_module affecting NGINX Open Source and NGINX Plus. New York State Information Technology Services advisory 2026-051, dated 18 May 2026, reports a proof of concept and cites a VulnCheck report that CVE-2026-42945 was exploited in the wild. That makes CVE-2026-42945 an exploitation-priority item even for teams whose configurations do not match CVE-2026-15176.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Recommended response order
- Identify all NGINX products, versions and internet-facing listeners.
- Upgrade Open Source, Plus, Instance Manager, WAF for NGINX, DoS for NGINX, Gateway Fabric and Ingress Controller to the fixed versions in the table.
- For App Protect WAF or App Protect DoS branches without a listed candidate, plan migration to a fixed supported branch and apply configuration and network mitigations immediately.
- Remove or redesign affected
alias/rewritelocations and unnecessary$request_filenamelog references if patching is delayed. - Review HTTP/3, rewrite, proxy/HTTP/2 and gRPC modules against the other 2026 advisories.
- Investigate crashes, anomalous requests and unexplained configuration changes as potential exploitation, prioritizing CVE-2026-42945 because government guidance reports in-the-wild activity.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
