CVE-2026-15176: CWE-122 Heap-based Buffer Overflow in F5 NGINX Plus

The vulnerability arises from improper handling of the $request_filename variable in specific NGINX configurations involving alias, rewrite, set, return directives, or access log formats. This leads to a heap-based buffer overflow in the NGINX worker process. Exploitation requires sending specially crafted HTTP requests without authentication. The impact includes denial-of-service via worker process restart and potential remote code execution on systems without effective ASLR protections. The issue affects several versions of NGINX Plus and Open Source, including versions >=37.1.0 <37.1.0.1, >=37.0.0 <37.0.5.1, >=R33 through >=R36, >=1.31.0 <1.31.7, and >=0.1.29 <1.30.6. There is no known exploit in the wild as of publication.

Remote attackers can cause denial-of-service by triggering a heap buffer overflow that restarts the NGINX worker process. Additionally, on systems with ASLR disabled or bypassed, attackers may achieve remote code execution. The vulnerability affects only the data plane; there is no control plane exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor F5's advisories for updates. Until a fix is available, avoid configurations combining alias with rewrite and set or return directives referencing $request_filename, or using $request_filename in access log formats, if feasible.