nginx CVE-2026-15176 and CVE-2026-93479: heap buffer overflows fixed in 1.30.6 and 1.31.7
Published 24/10/2026 21:00
Timeline
2 events over 20 h
- 24/10/2026 00:14Corroboratedoss-security mailing list+20 h
- 24/10/2026 21:00Published on WatchtowerPro CISO
In short
nginx has released fixes for two heap buffer overflow flaws in NGINX Open Source and NGINX Plus. The fixed versions are 1.30.6 (stable) and 1.31.7 (mainline), released on 14/10/2026. A remote attacker who does not need to log in can trigger either flaw, but only when the server uses a specific configuration. The usual result is a crashed worker process (denial of service).
Affected versions
- NGINX Open Source and NGINX Plus are affected. Versions past F5's end of technical support have not been evaluated.
- CVE-2026-15176 affects nginx 0.1.29 up to and including 1.31.6, according to GitHub pages that say they copied nginx.org. This range is unverified.
- CVE-2026-93479 affects nginx 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6, according to GitHub pages that say they copied nginx.org. This range is unverified. Red Hat says this flaw is a regression caused by the fix for CVE-2026-42533.
- CVE-2026-15176 is reachable only with this configuration: a location that combines 'alias' with 'rewrite', plus a 'set' or 'return' that uses $request_filename. Using $request_filename in an access-log format is also enough to trigger it.
Fixed in
- 1.30 branch: 1.30.6
- 1.31 branch: 1.31.7
What to do now
- Update nginx to 1.30.6 (stable) or 1.31.7 (mainline) or later. Both were released on 14/10/2026 and also fix CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205.
- If you use distribution packages, install the patched package where one exists. For Debian trixie this is 1.26.3-3+deb13u10 (DSA-6575-1); for Debian sid it is 1.30.6-2. Debian bookworm, Red Hat Enterprise Linux 8, 9 and 10, and Ubuntu do not have a fixed package yet. Ask your hosting provider when the update will be installed.
- Until the update is installed, apply Red Hat's interim measure for CVE-2026-93479. In 'map' blocks, replace unnamed regex captures ($1, $2 and so on) with named captures, and use them only in the same block as the regex match.
- Until the update is installed, check your nginx configuration for CVE-2026-15176. Look for locations that combine 'alias' with 'rewrite' and use $request_filename in 'set' or 'return', and for $request_filename in 'log_format'. Remove those combinations where possible. Red Hat says no official mitigation exists for this CVE, so this only removes the known trigger conditions.
- Make sure ASLR is enabled on the server, or ask your hosting provider to confirm it is.
- Be aware that these interim measures reduce exposure but do not make a server safe. Only the update fixes the flaws.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run nginx, at which version, fixed or not - and what each one needs.
Main sources
nginx RCEs CVE-2026-93479, CVE-2026-15176 Research · CVE-2026-15176 - Red Hat Customer Portal Research · CVE-2026-15176 Research