WARNING: Heap-Based Buffer Overflows in NGINX Plus and NGINX Open Source Can Be Exploited to Cause Denial of Service or Code Execution, Patch Immediately!

This advisory details two high-severity heap-based buffer overflow vulnerabilities in multiple NGINX Open Source and NGINX Plus versions (CVE-2026-15176 and CVE-2026-93479). An unauthenticated attacker can trigger these via crafted HTTP requests to cause worker crashes and, in certain environments, potentially execute code; the CCB urges immediate patching and enhanced monitoring.