CVE-2026-15176: The alias Rewrite Overflow That Survived Since 2005

The oldest of the five NGINX flaws fixed in 1.30.6 and 1.31.7 is also the one with the widest version range. CVE-2026-15176 affects releases from 0.1.29 onward, which means it has been present in essentially every NGINX build shipped since May 2005. F5 rates it 9.2 Critical on CVSS v4.0, and F5's own engineers are credited with finding it.

The mechanism

The flaw lives in the gap between two phases of request handling. NGINX first selects a location, then, if that location contains a rewrite , it can change the request URI and start location selection again. During the interval after the rewrite and before the next location is chosen, the request still carries the old location's context.

If that old location used alias , and if anything in that window reads $request_filename , NGINX maps the rewritten URI onto a file path using a prefix that was sized for the pre-rewrite URI.…