OSG-SEC-2026-10-15 IMPORTANT-NGINX Vulnerabilities Including Potential Remote Code Execution

Dear OSG Security Contacts,

NGINX released versions 1.30.6 and 1.31.7, fixing five security vulnerabilities [1] [3]. The most significant is CVE-2026-15176, a heap buffer overflow that may allow remote code execution in NGINX installations using a specific configuration. The other vulnerabilities require additional configuration features.

IMPACTED VERSIONS:

NGINX versions 0.1.29 through 1.31.6 are affected by CVE-2026-15176. The vulnerability has therefore existed since the NGINX release from May 2005. The other vulnerabilities affect various NGINX releases; sites should consult the NGINX security advisory for the exact affected version ranges. Fixed upstream versions are: NGINX 1.30.6 NGINX 1.31.7 Operating-system vendors may provide fixes through backported security updates without changing the NGINX version number.

WHAT ARE THE VULNERABILITIES:

CVE-2026-15176 — Heap buffer overflow / possible RCE

A heap buffer overflow in NGINX can potentially lead to denial of service or remote code execution. Exploitation requires a specific NGINX configuration involving an alias directive used with rewrite, together with a set or return directive referencing $request_filename. NGINX also identifies a potentially affected configuration where $request_filename is used in an access-log format.

A remote attacker able to send requests to an affected server may trigger heap memory corruption. Although the vulnerable code has existed since 2005, not every NGINX installation is exploitable; the specific configuration is required.

The four additional vulnerabilities fixed in the same release are:

CVE-2026-93479 — A memory-safety issue involving specific map/regular-expression configurations that may potentially result in code execution.

CVE-2026-97205 — A use-after-free issue involving specific asynchronous I/O and SSI configurations that may potentially result in code execution.

CVE-2026-97629 — A TLS session issue that may allow session forgery and, under certain configurations, potentially bypass client-certificate authentication.

CVE-2026-95101 — An HTTP/3 request-body injection issue affecting NGINX configurations with HTTP/3 enabled.

WHAT YOU SHOULD DO:

OSG sites running NGINX should upgrade to a vendor-provided fixed version or apply the corresponding operating-system security update.

REFERENCES

[1] https://nginx.org/en/security_advisories.html
[2] https://github.com/advisories/GHSA-cvv4-j4mx-w8q5
[3] https://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html

Please contact the OSG security team at [email protected] if you have any questions or concerns. OSG Security Team