{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3af5nginx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-15176"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NGINX Plus","NGINX Open Source"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","dos","remote-code-execution","cve"],"_cs_type":"advisory","_cs_vendors":["F5"],"content_html":"\u003cp\u003eCVE-2026-15176 is a heap buffer overflow vulnerability affecting NGINX Plus and NGINX Open Source. The vulnerability arises when specific configuration directives are combined within an NGINX location block: the alias directive used in conjunction with a rewrite directive, or a set or return directive that references the $request_filename variable. Additionally, the vulnerability can be triggered if the $request_filename variable is included in an access log format directive.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker can exploit this flaw by sending crafted HTTP requests that trigger the buffer overflow within the NGINX worker process. While the primary documented impact is a denial-of-service condition resulting from worker process restarts, the memory corruption potentially allows for arbitrary code execution in environments where Address Space Layout Randomization (ASLR) is disabled or successfully bypassed. This is a data plane vulnerability and does not affect the NGINX control plane.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-15176 leads to worker process crashes, causing intermittent or persistent denial-of-service conditions for the affected web service. In sophisticated scenarios, the heap overflow primitive may enable remote code execution, threatening the confidentiality, integrity, and availability of the host server. The vulnerability impacts all NGINX Open Source and NGINX Plus installations utilizing the vulnerable directive combinations, posing a significant risk to internet-facing web infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize auditing NGINX configuration files to identify the use of the alias directive in combination with rewrite, set, or return directives that reference $request_filename.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eReview all custom 'log_format' configurations to ensure the $request_filename variable is not utilized in production access logs until a vendor patch is applied.\u003c/li\u003e\n\u003cli\u003eMonitor NGINX error logs for unexpected worker process crashes or segmentation faults, which may indicate exploitation attempts.\u003c/li\u003e\n\u003cli\u003eApply patches provided by F5 for NGINX Plus and NGINX Open Source as soon as they become available for your specific deployment version.\u003c/li\u003e\n\u003cli\u003eEnsure Address Space Layout Randomization (ASLR) is enabled and enforced at the operating system level for all NGINX host environments to increase the cost of exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:40:37Z","date_published":"2026-10-14T16:38:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nginx-heap-overflow/","summary":"CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.","title":"Heap Buffer Overflow in NGINX","url":"https://feed.craftedsignal.io/briefs/2026-10-nginx-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}