https://seclists.org/oss-sec/2026/q4/362: nginx RCEs CVE-2026-93479, CVE-2026-15176

Q: Which nginx deployments are potentially exposed to the reported use-after-free issue?

Both NGINX Plus and NGINX Open Source are identified as affected. The issue requires asynchronous file I/O (AIO) to be enabled in certain configurations and an SSI page containing include virtual commands to be processed.

Q: Is remote code execution possible in every affected configuration?

The reported impact includes memory corruption or unexpected worker-process termination. Code execution is described as possible when ASLR is disabled or when an attacker can bypass ASLR.

Q: What versions should be reviewed for these reported nginx issues?

The report states that the listed issues appear to affect Open Source nginx versions before 1.31.7 or 1.30.6. Review deployed version and release branch against those thresholds.

Published Oct 23, 2026

Updated

Affected Software

1 affected component

F5 Nginx<1.31.7, <1.30.6

Frequently Asked Questions

Which nginx deployments are potentially exposed to the reported use-after-free issue?

Both NGINX Plus and NGINX Open Source are identified as affected. The issue requires asynchronous file I/O (AIO) to be enabled in certain configurations and an SSI page containing include virtual commands to be processed.

Is remote code execution possible in every affected configuration?

The reported impact includes memory corruption or unexpected worker-process termination. Code execution is described as possible when ASLR is disabled or when an attacker can bypass ASLR.

What versions should be reviewed for these reported nginx issues?

The report states that the listed issues appear to affect Open Source nginx versions before 1.31.7 or 1.30.6. Review deployed version and release branch against those thresholds.

https://seclists.org/oss-sec/2026/q4/362: nginx RCEs CVE-2026-93479, CVE-2026-15176

Affected Software

Frequently Asked Questions

Which nginx deployments are potentially exposed to the reported use-after-free issue?

Is remote code execution possible in every affected configuration?

What versions should be reviewed for these reported nginx issues?

Company

Resources

Contact

Frequently Asked Questions

Which nginx deployments are potentially exposed to the reported use-after-free issue?

Is remote code execution possible in every affected configuration?

What versions should be reviewed for these reported nginx issues?