NGINX CVE-2026-15176

Exploitation requires a non-default NGINX configuration: a location block that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, OR $request_filename used within an access log_format directive. Given such a configuration, an unauthenticated remote attacker can trigger the overflow via crafted HTTP requests with no user interaction. Key limiting factors: (1) the specific directive combination is not present in default/typical deployments, substantially narrowing the exposed population; (2) full code execution only occurs when ASLR is disabled or can be bypassed - on default ASLR-enabled systems the realistic outcome is a worker-process crash/restart (DoS); (3) the advisory notes 'conditions beyond their control,' indicating a timing/race-like dependency that raises attack complexity. This is a data-plane-only issue with no control-plane exposure.

Signals conflict and must be weighed carefully. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.2) rates this critical, driven by network reachability, no authentication, and high confidentiality/integrity/availability impact. However, two factors pull real-world risk down sharply. First, AC:H is explicitly justified by the description's phrase 'along with conditions beyond their control,' plus a mandatory non-default configuration (a location combining the alias directive with rewrite and a set/return directive referencing $request_filename, or $request_filename used in a log_format directive). Second, the full code-execution impact only materializes 'on systems with ASLR disabled or when the attacker can bypass ASLR' - on modern default deployments ASLR is enabled, so the realistic outcome is a worker-process crash/restart (DoS), not RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Net: a genuinely high-impact bug in ubiquitous software, but its real priority is gated by a specific configuration prerequisite and by ASLR - treat it as 'patch promptly if you use the affected directive combination' rather than a mass-exploitation emergency. The VC:H/VI:H rating should be read as conditional (ASLR-dependent), which the description supports but the raw score does not convey.

An NGINX instance is configured with a location block using the alias directive together with rewrite and a set/return directive (or an access log format) referencing $request_filename. An unauthenticated remote attacker sends specially crafted HTTP requests that trigger a heap buffer overflow in the NGINX worker process, crashing it and causing a restart (denial of service); if ASLR is disabled or can be bypassed, the overflow may be leveraged into code execution. No public exploit code has been identified at time of analysis.