F5 published an out-of-band fix on 14 October 2026 for a heap overflow in NGINX, tracked as CVE-2026-15176. The vendor scores it 8.1 (High) on CVSS 3.1 and 9.2 (Critical) on CVSS 4.0. CISA's enrichment record lists exploitation as none.
What happened
The flaw sits in ngx_http_core_module. It is reachable when a location uses the alias directive together with rewrite, and a set, return, or access-log format reads $request_filename. An unauthenticated attacker can send a crafted HTTP request that overflows a heap buffer in the worker process and forces a restart. F5 says code execution is also possible if address-space randomisation is disabled or bypassed. This is a data-plane issue only. There is no public proof of concept, and F5 has not reported attacks.
Who is affected
- NGINX Open Source from 0.1.29 before 1.30.6, and 1.31.0 before 1.31.7.
- NGINX Plus 37.0.0 before 37.0.5.1, 37.1.0 before 37.1.0.1, and the R33 through R36 branches, which have no fix listed.
- Products that embed those builds, including NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.
A default install is not enough. The bad combination of alias, rewrite, and $request_filename has to be present.
What to do now
Upgrade NGINX Open Source to 1.30.6 or 1.31.7, and NGINX Plus to 37.0.5.1 or 37.1.0.1, before you change anything else.
- Search configs for alias inside a location that also rewrites the URI and reads $request_filename.
- If you cannot patch today, stop using alias in that location and stop using $request_filename.
- Reload only after the new binary is in place, then confirm the running version with nginx -v.
- Watch error logs for worker restarts that started after 14 October and do not match a planned reload.
What this means for South African businesses
Most local SME sites run NGINX as a reverse proxy in front of WordPress, Odoo, or a custom app, often on a VPS the MSP does not rebuild often. The risky config is uncommon, so this is not a drop-everything incident for every client, but an unpatched public web server is still the usual way into a small business. Treat any internet-facing NGINX you manage as in scope until the version is confirmed.
Source: F5, NGINX ngx_http_core_module vulnerability CVE-2026-15176.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.