many common nginx setups and hardening suggestions would make it very difficult to exploit. as well as any sort of distributed architecture that doesn't pin requests to clients.

there could be other undiscovered paths to exploit this vulnerability though. the PoC here uses the disclosed path for exploiting on patch day, minus mod_php.