NGINX CVE-2026-15176: critical alias rewrite overflow present since 2005

F5 disclosed CVE-2026-15176 in NGINX, rated 9.2 Critical on CVSS v4.0: a buffer overflow when alias and rewrite share a location and $request_filename is read. Versions 0.1.29 through 1.31.6 are affected; fixes ship in 1.30.6 and 1.31.7.

• Flaw affects every NGINX build since May 2005, range 0.1.29–1.31.6
• Overflow triggers when alias and rewrite share a location that reads $request_filename
• Impact is worker crash and possible code execution
• Fixed in 1.30.6 and 1.31.7; workaround is avoiding alias alongside rewrite