CVE-2026-15176: NGINX Heap Buffer Overflow Vulnerability in Bitnami NGINX
Summary
CVE-2026-15176: NGINX ngx_http_core_module vulnerability. Affects nginx across 2 version ranges.
>= 0.1.29, < 1.30.6
>= 1.31.0, < 1.31.7
Fixed in 1.30.6 or 1.31.7, depending on the release line you run. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-15176 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. It is widely used for serving static content, load balancing, and as a reverse proxy for HTTP and other protocols. However, certain configurations can expose NGINX to vulnerabilities, including the one identified as CVE-2026-15176, which affects both NGINX Plus and NGINX Open Source versions.
Vulnerability Detail
A vulnerability exists in NGINX when a location is configured with the alias directive alongside rewrite and a set or return directive that references the $request_filename variable. This can also occur when the $request_filename variable is used in an access log format directive. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, potentially leading to a heap buffer overflow in the NGINX worker process. This may cause a denial-of-service (DoS) condition or allow code execution on systems with Address Space Layout Randomization (ASLR) disabled.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.1.29, < 1.30.61.30.6 -
>= 1.31.0, < 1.31.71.31.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the alias directive in conjunction with rewrite and set or return directives that reference the $request_filename variable. Additionally, consider enabling ASLR on your systems to mitigate potential exploitation.
Conclusion
CVE-2026-15176 is a critical vulnerability in NGINX that could lead to severe consequences if not addressed. It is essential to update to the latest patched versions or apply workarounds to mitigate risks.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-15176 is a vulnerability in NGINX that can lead to a heap buffer overflow, potentially allowing remote code execution or denial-of-service.
The vulnerability affects NGINX versions prior to 1.30.6 and 1.31.7.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file.
Consider applying the workaround by avoiding certain configurations and enabling ASLR on your systems.
Detailed information can be found in the vulnerability report on the Bitnami GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
