F5 NGINX Plus/NGINX Open Source Alias/Rewrite/Set/Return Directives request_filename heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in F5 NGINX Plus and NGINX Open Source. This affects an unknown part of the component Alias/Rewrite/Set/Return Directives. The manipulation of the argument request_filename results in heap-based overflow. This vulnerability is identified as CVE-2026-15176. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in F5 NGINX Plus and NGINX Open Source (version unknown). Affected is an unknown function of the component Alias/Rewrite/Set/Return Directives. The manipulation of the argument request_filename with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The advisory is shared for download at my.f5.com. This vulnerability is traded as CVE-2026-15176 since 07/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• F5

Name

• NGINX Open Source
• NGINX Plus

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion