NGINX Patched a 9.2 Flaw and Called It Medium

F5 shipped NGINX 1.31.7 and 1.30.6 on October 14, closing five flaws in one release. The loudest, NGINX CVE-2026-15176, carries a 9.2 score under CVSS 4.0 in its CVE record and 8.1 under 3.1. The vendor’s own advisory page rates the same flaw medium. Both numbers are public, and the gap between them is the triage decision.

Here is what the advisory assumes you already know. The overflow lives in the core module and needs a location block that pairs the alias directive with rewrite and a set or return directive reading $request_filename, or the same variable in a log format directive. The vulnerable range starts at 0.1.29, so this is an old code path, not new code. The realistic outcome the vendor states is a worker restart. Code execution needs memory layout randomization disabled or bypassable, which the advisory calls beyond the attacker’s control.

The score and the exposure disagree

A restarting worker is a denial of service, and in a shared ingress tier one crash loop in front of every service is an outage. That is why the score is not wrong. It is also not a number that maps to your cluster until someone greps the config. Look for alias sitting next to rewrite, and for $request_filename in log format directives. Empty results mean a scheduled upgrade. A hit means this belongs in the change window you already have this week.

The fixed build may not reach the tier that faces the internet

NGINX is the data plane under most ingress controllers and reverse proxies. Ingress NGINX, the controller the Kubernetes project says roughly half of cloud native environments rely on, was archived in March 2026 and gets no patch releases for flaws reported after its end of life. Upstream shipped a fixed build, so reach depends on who assembles your controller image. The same release closes a buffer overflow in script evaluation, a request body injection in HTTP/3, a forgery when TLS session tickets rotate, and a use-after-free with asynchronous file input and output enabled. Those four sit in default configurations.

Ask three questions. Does any location block pair alias with rewrite, does anything read $request_filename, and who builds the nginx that terminates your external traffic? Our piece on the Kubernetes 1.34 end of life covers the same maintenance squeeze, and the CISA exploited list is where a flaw lands once someone uses it in the wild.