Nginx buffer overflow CVE-2026-15176: affected versions and upgrade guidance

CVE-2026-15176 Nginx

Nginx disclosed buffer overflow CVE-2026-15176 when alias is used with rewrite. Versions 0.1.29–1.31.6 are affected; check the running version and upgrade to 1.31.7+ or 1.30.6+.

Nginx buffer overflow CVE-2026-15176: affected versions and upgrade guidance

At a glance
Nginx disclosed buffer overflow CVE-2026-15176 involving alias used with rewrite.
Nginx 0.1.29–1.31.6 is affected; severity is rated medium.
Upgrade to Nginx 1.31.7+ or 1.30.6+, which are unaffected versions.
Use nginx -v to check the running version.

In this article

Nginx published an advisory for buffer overflow CVE-2026-15176, which involves using alias with rewrite. Administrators can review the Nginx advisory and prioritize upgrading affected versions.

Overview and technical details

The vulnerability is described as a buffer overflow that occurs when alias is used with rewrite. Its severity is rated medium.

Field	Details
Product	Nginx
Vulnerability ID	CVE-2026-15176
Severity	Medium
Source	Nginx Security advisory

Affected systems

Product	Affected versions	Unaffected versions
Nginx	0.1.29–1.31.6	1.31.7+ or 1.30.6+

Mechanism and impact

The buffer overflow occurs when Nginx uses alias with rewrite. The advisory identifies this configuration condition but does not specify further impacts; it should not be inferred to cause a different type of impact.

System checks

Check the running Nginx version with the following command:
```
nginx -v
```
Nginx 1.31.7+ or 1.30.6+ is unaffected; versions in the 0.1.29–1.31.6 range need to be upgraded.

Remediation and mitigation

Upgrade affected Nginx installations to version 1.31.7+ or 1.30.6+. These versions are confirmed to be unaffected.

References: Nginx Security