CVE-2026-15176

Think of your web server like a mail sorting room with a very specific filing shortcut (the alias setting) combined with a label-rewriting step. If both are used together, someone outside can hand in a specially crafted request that confuses the sorting machine badly enough to jam it — or, in a poorly protected room, even trick it into doing something it shouldn't. Most sites don't use this exact combination, but if yours does, the machine (your website) could go down or worse.

This matters to you if your website or application runs on nginx (open source) or NGINX Plus. It only applies if your configuration uses the alias directive together with rewrite, set, or return referencing $request_filename, or uses $request_filename in an access log format — ask your hosting provider or IT team to check this specific setup.

This is rated urgent: an unauthenticated attacker can trigger it over the network with no login or user interaction needed, and the flaw can cause a server crash or, in weaker-hardened environments, remote code execution. No active exploitation or public exploit code has been reported yet, but given the severity and that fixes are already available, this should be addressed without delay rather than waited on.

1. Audit nginx/NGINX Plus configs for locations using alias combined with rewrite + set/return referencing $request_filename, or access_log formats using $request_filename. 2. Upgrade: nginx open source → 1.31.7 (stable) or 1.30.6 (mainline/legacy branch); NGINX Plus → 37.1.0.1 or 37.0.5.1 depending on release line. 3. If upgrade must be delayed, apply the vendor workaround: remove alias from the affected location or eliminate use of $request_filename in rewrite/log directives. 4. Verify ASLR is enabled on the host OS, since the vendor advisory notes RCE is more feasible when ASLR is disabled or bypassed. 5. No CISA KEV listing and no confirmed in-the-wild exploitation at this time, so there is no mandated remediation deadline, but treat this as a high-priority patch cycle item given the unauthenticated network vector and CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H). 6. Monitor nginx worker process logs for unexpected crashes/restarts post-deployment as an indicator of attempted exploitation, and track NGINX/F5 advisories for any future exploitation updates.

CVSS 3.1 score 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high impact but high attack complexity due to the specific configuration precondition (CWE-122, heap-based buffer overflow). Not listed in CISA KEV; no dated news confirms active exploitation, and no public exploit code exists, placing this at PoC/theoretical maturity. EPSS predicts a low near-term exploitation likelihood with a flat trend. Despite low current exploitation signals, the unauthenticated network vector, lack of required user interaction, and potential for RCE on ASLR-disabled systems justify prioritizing the patch (nginx 1.31.7/1.30.6, NGINX Plus 37.1.0.1/37.0.5.1) ahead of confirmed exploitation.