DEV Community

Anoymask
Anoymask

Posted on

NGINX CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479: Memory Corruption in Non-Default Configurations

#security #threatintel

1. Basic Information

2. Executive Summary

Three memory corruption vulnerabilities affect specific non-default NGINX configurations involving alias and rewrite, AIO and SSI, or map with regular expressions. They can cause remote denial of service (DoS) and may allow code execution if ASLR is disabled or bypassed.

3. Attack Flow

Potential Memory Corruption via Remote Request

  1. An attacker sends a crafted HTTP request to an NGINX server running a vulnerable version with a matching non-default directive configuration.
  2. A buffer overflow or use-after-free occurs within the worker process, potentially leading to a process crash or restart.
  3. Under conditions where ASLR is disabled or bypassed, it is described as potentially leading to code execution, though active exploitation in real environments has not been confirmed at the time of publication.
CVE Number Vulnerability Type Required Non-Default Configuration Conditions NGINX Open Source Affected Range
CVE-2026-15176 Buffer Overflow Configurations combining alias and rewrite with references to $request_filename in set, return, or access log formats 0.1.29 to 1.31.6
CVE-2026-97205 Use-After-Free Specific configurations with AIO enabled when processing Server Side Includes (SSI) pages containing include virtual 0.8.11 to 1.31.6 (F5 CNA product table lists only 1.30/1.31 branches, older branches are not considered safe)
CVE-2026-93479 Buffer Overflow Configurations where capture variables are referenced in root or access log formats before the output variable of a map using regular expressions, or paths using non-cached variables in string expressions under specific conditions 1.30.0 to 1.30.5, 1.31.2 to 1.31.6

4. Attacker Positioning and Prerequisites

  • An unauthenticated remote attacker who can reach the target NGINX HTTP/HTTPS endpoint over the network.

5. Observable Indicators for Victims and Administrators

Victim Perspective

  • May manifest as connection failures, an increase in 5xx errors, or brief service disruptions.

Administrator Perspective

  • Worker process crashes or restarts, core dump output, and the presence of matching non-default configurations combined with specific requests.

6. Success and Failure Conditions

Success Conditions

  • Using a vulnerable version of NGINX.
  • For CVE-2026-15176, the configuration must combine alias and rewrite with references to $request_filename in set, return, or access log formats. For CVE-2026-97205, AIO must be enabled in specific configurations processing SSI pages containing include virtual. For CVE-2026-93479, capture variables must be referenced in root or access log formats before the output variable of a map using regular expressions, or non-cached variables must be used in string expressions under specific conditions.
  • Achieving code execution requires additional conditions such as disabled or bypassed ASLR.

Scope of Affected Versions

CVE-2026-15176: 0.1.29 to 1.31.6. CVE-2026-97205: 0.8.11 to 1.31.6. CVE-2026-93479: 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6. Actual exploitation requires respective directive and configuration conditions.

Failure Conditions and Defensive Branches

  • Updating NGINX Open Source to 1.31.7 or later in the 1.31 branch, or 1.30.6 or later in the stable 1.30 branch, remediates all three issues.
  • As a temporary workaround prior to applying updates, remove the configurations satisfying each CVE's conditions, verify settings, and check for service impacts. Do not treat general uses of alias or regular expressions as uniformly dangerous, and do not rely solely on enabling ASLR as a permanent fix.

Remediation Standard

NGINX Open Source 1.31.7 or later in the 1.31 branch, or 1.30.6 or later in the stable 1.30 branch. For F5 commercial products, check the fixed version in each advisory.

7. What Happens Upon Success

  • Denial of service (DoS) due to NGINX worker process crashes and restarts.
  • Potential code execution under worker process privileges if additional conditions are met.

8. Observable Logs

These are investigation candidates. Availability depends on the product, privileges, and log configuration/retention policies. The absence of logs does not prove the absence of compromise.

  • Email: Inference: This is not an attack originating from email.
  • Proxy/SWG/DNS: Inference: While abnormal URIs, rewrite processing, and HTTP bodies can be reviewed in WAF or reverse proxy logs, specific attack payload patterns cannot be definitively determined from public information alone.
  • Endpoint/EDR: Check for NGINX worker crashes, signal terminations, core dump generation, and the spawning of suspicious child processes.
  • Identity/IdP: Inference: Exploitation does not require authentication.
  • SaaS/Cloud: Verify ingress and gateway deployment versions, configuration revisions, and rollout timestamps.
  • Network: Correlate requests immediately preceding crashes from the same source IP with service restart timings.

9. Scope of Success Verification

Attack Attempts and Successful Compromise Unconfirmed

  • Scope: Official statements from F5 and NGINX at the time of publication.
  • Basis: Unconfirmed: This confirms the publication of vulnerabilities and their success conditions, not recorded attack attempts or successful compromises in real environments. Statements that F5 has not confirmed active exploitation are limited to the scope cited by secondary reporting.

Criteria for Internal Assessment

  • Separate contact, execution, information retrieval, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from NGINX worker crashes, core dump outputs, and unexpected restarts.
  • Initial Verification: Check running versions, the presence of relevant directives, internet exposure status, ASLR settings, and recent configuration change history.
  • Endpoint/Server Investigation: Preserve core dumps, error logs, records of worker child processes, and evidence of binary and package integrity.
  • Authentication/Cloud Investigation: Inference: If there are indications of code execution, check for unauthorized use of service accounts or Kubernetes secrets.
  • Subsequent Actions: Expand the investigation scope to look for signs of suspicious process execution, file writes, outbound communications, and container escapes.
  • Containment: Update to a fixed version or apply temporary workaround configurations, and isolate hosts or containers where anomalies are confirmed.
  • Decision Categories: Triage step-by-step between crafted request delivery, worker crashes, code execution, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Event: Create alerts by combining NGINX worker segmentation violations or core dump outputs with the presence of relevant configuration settings.
  • Timeline Correlation: Correlate incoming abnormal requests -> worker crashes -> automatic restarts -> unknown child process spawning or outbound communication chronologically.
  • Threat Hunting: Inventory internet-facing instances using any of these combinations: alias + rewrite, AIO + SSI, or map + regular expressions.
  • Log Limitations: Worker crashes alone do not prove successful exploitation or code execution, and identifying reproduction conditions becomes difficult if request bodies are not logged.
  • Priority Countermeasures: Prioritize version updates, inventorying applicable settings, retaining core dumps and error logs, and minimizing worker privileges.

12. Facts, Inference, and Hypothesis

Facts

  • CVE-2026-15176 causes a buffer overflow in specific configurations combining alias and rewrite.
  • CVE-2026-97205 causes a use-after-free in specific processing using AIO.
  • CVE-2026-93479 causes a buffer overflow in script evaluation processing using map and regular expressions.
  • Official NGINX advisories list versions 1.31.7 and 1.30.6 and later as unaffected, rating all issues with a "medium" severity.
  • Official F5 CNA records explain the possibility of remote denial of service (DoS) as well as code execution if ASLR is disabled or bypassed. These are data plane issues and do not involve management plane exposure.
  • According to secondary reports, F5 had not confirmed active exploitation in real environments at the time of publication.

Inference

  • Rather than assuming code execution from the start, analysts must first verify the presence of matching configuration conditions, worker crashes, core dumps, and restart logs.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application low While exploitation potential via remote requests is described, active exploitation in real environments remains unconfirmed. Definition

14. Unknowns and Additional Investigation

  • The availability of fixed versions for each commercial product and edition requires individual verification. For the AIO vulnerability (CVE-2026-97205), the official NGINX list identifies versions 0.8.11 to 1.31.6 as affected, whereas the F5 CNA product table lists only the 1.30/1.31 branches; therefore, older branches cannot be considered safe. Additionally, all conditions necessary for stable code execution remain undetermined.

15. Impact on SOCs and Organizations

Organizations running NGINX as a reverse proxy, Kubernetes Ingress, or API gateway should go beyond version checks and inventory the specific configuration conditions involving alias/rewrite, AIO/SSI, and map/regular expressions.

16. Summary by Target Audience

  • For SOCs: Correlate NGINX worker crashes and restarts, abnormal requests, and core dump outputs with configuration change histories.
  • For Administrators: Update NGINX Open Source to 1.31.7 or later in the 1.31 branch, or 1.30.6 or later in the stable 1.30 branch. If immediate updates are not possible, temporarily remove the combination of directives that fulfill the success conditions.
  • For End Users: No action is required on the end-user side. Follow administrator instructions if service disruptions occur.

Top comments (0)