CVE-2026-15176: The alias Rewrite Overflow That Survived Since 2005

The oldest of the five NGINX flaws fixed in 1.30.6 and 1.31.7 is also the one with the widest version range. CVE-2026-15176 affects releases from 0.1.29 onward, which means it has been present in essentially every NGINX build shipped since May 2005. F5 rates it 9.2 Critical on CVSS v4.0, and F5's own engineers are credited with finding it.

The mechanism

The flaw lives in the gap between two phases of request handling. NGINX first selects a location, then, if that location contains a rewrite, it can change the request URI and start location selection again. During the interval after the rewrite and before the next location is chosen, the request still carries the old location's context.

If that old location used alias, and if anything in that window reads $request_filename, NGINX maps the rewritten URI onto a file path using a prefix that was sized for the pre-rewrite URI. When the location's prefix is longer than the rewritten URI, that mapping overflows a buffer in the worker process.

$request_filename is not an exotic directive. It appears in return, in set, in if, in add_header, and in access-log formats. An operator who logs the resolved file path, or who returns it, or who adds a header derived from it, satisfies the read condition without ever intending to touch internals.

Exploitation conditions

Three elements must coincide. The location must use alias. A rewrite reachable in that location must change the URI. And something must read $request_filename during the window described above.

An attacker who can send requests to such a location can drive the overflowing mapping. F5's assessment is that this leads to a worker crash and possibly to code execution. A crash alone is a denial of service against the listener; code execution inside a worker inherits that worker's privileges, which on a typical deployment is an unprivileged service account, but a compromised worker still handles traffic and holds session material.

Affected range and why it is broad

The range 0.1.29 through 1.31.6 is the widest of the five issues and covers two decades of production installs. Many long-lived configurations mix alias and rewrite, particularly when a static subtree was moved and a rewrite kept old URLs working. The combination is not rare in inherited configuration files, and because nothing complains about it, it survives migrations.

Older branches remain inside the range. NGINX publishes fixes only for the stable and mainline branches, so a server pinned to 1.28 that has not received a distribution backport is still exposed after this release ships.

Impact

The impact has two levels. The first is availability: a crafted request can terminate a worker, and repeated requests can keep workers cycling, which degrades service without any data compromise. The second is integrity: memory corruption in a worker can, in the wrong conditions, be leveraged into code execution. F5's rating treats the second level as the defining one.

The reason to treat this as urgent rather than theoretical is the exposure window. A flaw that has existed since 2005 has had two decades in which configurations could accumulate the exact combination, and it required no attacker-supplied secret, only a request to the right location.

Remediation

Upgrade to 1.30.6 or 1.31.7.

For teams that cannot upgrade immediately, F5's workaround is to stop using alias in any location that also rewrites, and to stop reading $request_filename in that context. In practice the simplest form is to convert the affected location to use root with an adjusted path, or to move the rewrite into a separate location block so that the alias and the rewrite never share a context.

Logging deserves a specific mention. Access-log formats that include $request_filename are a common source of the read condition, and they are usually inherited from a template rather than written deliberately. Audit log_format definitions before assuming the condition is absent.

How to check

Run nginx -T and find every location block containing alias. For each, check whether the same block contains rewrite, and check whether the resolved path is referenced anywhere in that block or in the access-log format applied to it. Where both are present, that location is the one to fix first.

Externally, the flaw does not advertise itself. There is no banner, no version string and no response signature that identifies a vulnerable configuration, which is why configuration review and not scanning is the reliable test.

Sources

• NGINX security advisories: https://nginx.org/en/security_advisories.html
• F5 advisory K000162416: https://my.f5.com/manage/s/article/K000162416
• Alias handling fix commit: https://github.com/nginx/nginx/commit/f8a23425bd6840c4c36b4264edf576ba3646156f
• NGINX download page: https://nginx.org/en/download.html