Read the docs
TI-2026-73990 Aliases CVE-2026-15176GHSA-cvv4-j4mx-w8q5

Heap buffer overflow in NGINX alias and rewrite handling

Priority MEDIUM 44CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

F5 NGINX Plus and NGINX Open Source are affected when an alias location uses rewrite with set or return referencing $request_filename. A heap buffer overflow (CWE-122) lets crafted HTTP requests overflow a buffer in the worker process. An unauthenticated remote attacker can crash the worker process and may execute code if ASLR is disabled or bypassed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00998 62nd percentileScored 2026-11-07
Fix Partial NGINX Plus (F5): 37.1.0.1, 37.0.5.1NGINX Open Source (F5): 1.31.7, 1.30.6Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Plus37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later37.1.0.1, 37.0.5.1Patch availableCNA
F5NGINX Open Source1.31.0 to before 1.31.7; 0.1.29 to before 1.30.61.31.7, 1.30.6Patch availableCNA
  • NGINX Plus VendorF5 Affected 37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later Fixed in 37.1.0.1, 37.0.5.1 Patch available CNA
  • NGINX Open Source VendorF5 Affected 1.31.0 to before 1.31.7; 0.1.29 to before 1.30.6 Fixed in 1.31.7, 1.30.6 Patch available CNA

Remediation

Upgrade NGINX Plus to 37.1.0.1 or 37.0.5.1 and NGINX Open Source to 1.31.7 or 1.30.6. Red Hat Hardened Images are fixed by RHSA-2026:83427. Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 as affected with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA NGINX Plus (F5) Fixed in 37.1.0.1, 37.0.5.1
  • Fix · CNA NGINX Open Source (F5) Fixed in 1.31.7, 1.30.6

Red Hat 1 advisory

  • RHSA-2026:83427 Released 2026-10-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nginx-1.30.6-1.hum1@aarch64, nginx-1.30.6-1.hum1@s390x, nginx-1.30.6-1.hum1@src +34

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Open Source 1.30.6, 1.31.7

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-74056 Heap buffer overflow in NGINX map directive regex matchingPriority MEDIUM 44
    • TI-2026-74062 Use-after-free in NGINX ngx_http_core_module can crash workersPriority MEDIUM 43
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 5 records →
  • Release ·

    F5 NGINX Plus 37.0.5.1, 37.1.0.1

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74056 Heap buffer overflow in NGINX map directive regex matchingPriority MEDIUM 44
    • TI-2026-74062 Use-after-free in NGINX ngx_http_core_module can crash workersPriority MEDIUM 43
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:83427
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-15176
  2. 2026-10-14 Alias added: GHSA-cvv4-j4mx-w8q5
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW
  5. 2026-10-16 CISA SSVC decision points changed
  6. 2026-10-16 Priority changed: LOW → MEDIUM
  7. 2026-10-16 Fix available: RHSA-2026:83427 · Red Hat
  8. 2026-10-16 Fix available: Red Hat Hardened Images · Red Hat
  9. 2026-10-16 CVSS score added · Red Hat
  10. 2026-10-25 EPSS moved to the 50th–90th percentile
  11. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences