CVE-2026-15176 and nginx's October 2026 security release

02Who is affected?

Open source nginx from 0.1.29 through 1.31.6 is affected; 1.31.7 (mainline) and 1.30.6 (stable) are the first fixed releases. According to the NGINX Plus release notes, NGINX Plus received the fix earlier, in PLS.37.1.0.1 (CR) and PLS.37.0.5.1 (LTS) on 2 September 2026. Distribution coverage is uneven: Debian fixed trixie in 1.26.3-3+deb13u10 (DSA-6575-1), but its tracker still listed bookworm as vulnerable on 24 October 2026, and Ubuntu's tracker still showed the issue as needing triage.

The configuration precondition is important. Using alias is common, and using rewrite is common, but reading $request_filename immediately after a URI-changing rewrite inside an alias location is a narrower pattern. nginx.org lists the severity as medium while F5's CVSS 4.0 base score is 9.2, and Red Hat rates it Important at CVSS 3.1 8.1, explicitly lower than the CVSS 4.0 rating because exploitation depends on a specific server configuration.

03How do I check my configuration?

Dump the merged configuration and look for locations that combine alias with rewrite, and for any use of $request_filename. An awk pass flags locations that contain both an alias and a rewrite; a grep finds $request_filename references to review.

nginx -T 2>/dev/null > /tmp/nginx-full.conf

# locations that contain BOTH alias and rewrite
awk '/^[[:space:]]*location[[:space:]]/{loc=$0; a=0; r=0; n=NR}
     /^[[:space:]]*alias[[:space:]]/{a=1}
     /^[[:space:]]*rewrite[[:space:]]/{r=1}
     a&&r&&!p[n]++{print n": "loc}' /tmp/nginx-full.conf

# any use of $request_filename to review
grep -nE '\$request_filename' /tmp/nginx-full.conf

04The four other CVEs in the same release

nginx 1.31.7 / 1.30.6 closed five issues. Treat them as one patch, but know which of your configurations each one needs, because they are independent and target different modules.

CVE-2026-93479 is the one to watch if you already patched in July: it is a residual overflow in the script-engine hardening that shipped for the map heap overflow, CVE-2026-42533, affecting document-root calculation and request logging in nginx 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5. CVE-2026-97629 is notable because a forged TLS session can let an attacker bypass client-certificate verification where mutual TLS is used, the same outcome as the earlier session-resumption flaw CVE-2025-23419.

One SSI issue is easy to confuse with CVE-2026-97205: CVE-2026-56434 (SSI with proxy_pass and proxy_buffering off, exploitable only by a man-in-the-middle controlling upstream responses) was fixed in the July release (1.31.3 / 1.30.4), not this one. If you run SSI, make sure you are past both releases.

05How do I fix the October release issues?

Upgrade to nginx 1.31.7 or 1.30.6, or your distribution's patched package, and restart nginx afterwards; one open source upgrade closes all five. On NGINX Plus, four of the five were fixed in PLS.37.1.0.1 / PLS.37.0.5.1, but CVE-2026-95101 needs PLS.37.2.0.1 (CR) or PLS.37.0.7.1 (LTS), released on 14 October 2026.

If you must stagger the work, the per-CVE configuration mitigations are below. They remove triggers; they are not a substitute for the patch, and several of these bugs have no safe config workaround beyond disabling the feature.

• CVE-2026-15176: avoid reading $request_filename after a URI-changing rewrite in an alias location; use root instead of alias where the layout allows, or do the rewrite in a location without alias and let a new location pick it up
• CVE-2026-93479: do not reference a regex map's capture variables before the map output in root or log_format expressions
• CVE-2026-97205: disable asynchronous file I/O (aio) or disable SSI 'include virtual' until patched
• CVE-2026-97629: configure an explicit ssl_session_ticket_key file, or disable session tickets, so no slot is left uninitialised
• CVE-2026-95101: this is an HTTP/3 parsing bug — patching is the fix; disabling HTTP/3 removes the surface

06What a reverse proxy can and cannot do

Most of these are internal nginx bugs that a filter inside the same nginx cannot catch. CVE-2026-15176 and CVE-2026-93479 corrupt memory during request processing; CVE-2026-97205 is a use-after-free in file handling; CVE-2026-97629 is in the TLS stack. A web application firewall sitting in front of an unpatched origin reduces exposure and can absorb the crash-loop denial of service, in the way any reverse proxy shields an origin, but it does not patch the origin; see what virtual patching can and cannot do.

Two have an edge angle worth naming. CVE-2026-95101 is about bypassing client_max_body_size over HTTP/3, so request-size and body limits enforced at a separate, patched proxy tier add defence in depth. CVE-2026-97629 undermines client-certificate checks, so if you rely on mutual TLS for authentication, patching is the only real answer — an edge layer cannot restore a verification step that the server skipped. For the broader context on TLS, see what SSL/TLS is.

07Timeline