According to its banner, the version of Nginx running on the remote host is prior to 1.30.6 or 1.31.x prior to 1.31.7. It is, therefore, affected by multiple vulnerabilities:

- A use-after-free vulnerability exists in the ngx_http_core_module module when asynchronous file I/O (AIO) is enabled in certain configurations and a Server Side Includes (SSI) page containing include virtual commands is processed. A remote attacker can exploit this to cause memory corruption, a restart of the NGINX worker process, or potential code execution on systems with ASLR disabled. (CVE-2026-97205)

- A vulnerability exists in the ngx_http_ssl_module module when ssl_session_cache shared is configured without an explicit ssl_session_ticket_key file directive to automatically rotate SSL session ticket keys. A remote unauthenticated attacker can exploit this to forge client SSL sessions in a non-deterministic manner and bypass verification of client certificates. (CVE-2026-97629)

- A vulnerability exists in the ngx_http_v3_module module when HTTP/3 is used with the proxy_request_buffering on directive. A remote unauthenticated attacker can exploit this to inject data in the proxied request. (CVE-2026-95101)

- A heap-based buffer overflow vulnerability exists when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated attacker can exploit this to cause a denial of service or potential code execution on systems with ASLR disabled. (CVE-2026-93479)

- A heap-based buffer overflow vulnerability exists in the ngx_http_core_module module when a location uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log_format directive. An unauthenticated attacker can exploit this to cause a denial of service or potential code execution on systems with ASLR disabled. (CVE-2026-15176)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792146840 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792165116 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792146840 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1792164102 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792170794 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 95970257-c867-11f1-9006-3497f65b111b advisory.

    The nginx developers report:

           A buffer overflow might occur in a worker process when using the            alias directive if the request URI was changed by the rewrite            directive and was then mapped to a file path (CVE-2026-15176).


           A buffer overflow might occur in a worker process while evaluating            string expressions with variables, which affected the document root            calculation and request logging in the http and stream modules            (CVE-2026-93479).


           When using HTTP/3 a part of an unknown frame might be treated as the            request body, which might result in bypassing the            client_max_body_size limit or injecting data in the proxied            request (CVE-2026-95101).


           When using TLS session ticket key rotation, one of the keys was left            uninitialized, which might allow to forge a session (CVE-2026-97629).


           When using asynchronous file I/O (AIO), use-after-free might occur in            certain configurations if the SSI page has include virtual commands            (CVE-2026-97205).


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792164686 advisory.

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the     alias directive together with rewrite and a set or return directive referencing the $request_filename     variable. Alternatively, the same result could be achieved when the $request_filename variable is used in     an access log format directive. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This     vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to     possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
115713	Nginx < 1.30.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/10/16	2026/10/16	critical
115712	Nginx 1.31.x < 1.31.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/10/16	2026/10/16	critical
365995	Linux Distros Unpatched Vulnerability : CVE-2026-15176	Nessus	Misc.	2026/10/14	2026/10/16	critical
366524	Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792146840)	Nessus	Rocky Linux Local Security Checks	2026/10/16	2026/10/16	critical
366638	CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1792165116)	Nessus	CentOS Local Security Checks	2026/10/16	2026/10/16	critical
366518	AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792146840)	Nessus	Alma Linux Local Security Checks	2026/10/16	2026/10/16	critical
366639	CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS-STREAM8:CLSA-2026:1792164102)	Nessus	CentOS Local Security Checks	2026/10/16	2026/10/16	critical
366642	AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1792170794)	Nessus	Alma Linux Local Security Checks	2026/10/16	2026/10/16	critical
366445	FreeBSD : nginx -- multiple vulnerabilities (95970257-c867-11f1-9006-3497f65b111b)	Nessus	FreeBSD Local Security Checks	2026/10/16	2026/10/16	critical
366656	CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1792164686)	Nessus	CentOS Local Security Checks	2026/10/16	2026/10/16	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical