$request_filename is an NGINX variable that evaluates to the filesystem path for the current request. It is derived from the request URI and any path-mapping rules, such as root, alias, and rewrite-related directives. In practice, it tells NGINX what file or resource a request should map to after URI processing.
This matters in security because request-time path resolution can become a dangerous code path when configurations are complex. Attackers may craft requests that stress URI rewriting or alias mappings, causing unexpected path resolution, crashes, or unsafe memory handling in vulnerable builds. Defenders should review where $request_filename is used in logs, access control, redirects, and conditional logic, and test any configuration that combines it with rewritten URIs or nonstandard file mappings. Careful configuration review helps reduce both denial-of-service risk and the chance that a request reaches a flawed internal code path.