NGINX HTTP/3 heap buffer overflow in ngx_http_v3_module
Heap-based buffer overflow in NGINX's HTTP/3 module. Remote unauthenticated attackers can trigger denial-of-service or code execution in certain configurations.
- Vendor
- F5
- Product
- NGINX (Plus, Open Source, Ingress Controller, Gateway Fabric, Instance Manager)
- CVSS
- 8.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-15176 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-15176 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
CVE-2026-15176 is a heap-based buffer overflow in ngx_http_v3_module, the HTTP/3 implementation in NGINX. A remote attacker without any authentication can exploit this to crash the NGINX process or, depending on system configuration, execute arbitrary code.
F5 released out-of-band patches on October 19, 2026 covering NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager. Exact affected version ranges are listed in the F5 security advisory.
Mitigation before patching: Avoid using the alias directive inside location blocks and avoid using the $request_filename variable in those contexts. These are non-trivial configuration changes in many deployments, so patching is the preferred path.
NVD rates this CVSS 8.1 (high). No active exploitation in the wild has been reported as of the patch release.
Other F5 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97205 NGINX HTTP/3 use-after-free in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-93479 NGINX map directive use-after-free and buffer overflowwrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 2.2% | |
| CVE-2026-42533 nginx map directive regex-capture heap buffer overflow in workerwrite-up | [ HIGH ] | 8.1 | 0.9% | — |
| CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 2.3% | |
| CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability | [ HIGH ] | 8.8 | 4.5% | |
| CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.5% | |
| CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
