Does any distro disable ASLR by default?

If you were to do it by hand, nginx doesn't come to mind as a likely candidate.

Not the person you asked but I am not aware of any that disable ASLR by default, though most default to 1 which only enables ASLR for applications compiled to enable it vs 2 forcing it on or 3 on some distributions that use a hardened kernel. Rather than trusting any assumptions I prefer to run checksec [1] on every OS I touch. It's an old script but works just as well today as it did long ago. One may find that some applications are missing some basic hardening compile time options. The script is not an exhaustive test of all modern hardening options. Example of ASLR being forced on:

    # sysctl kernel.randomize_va_space
    kernel.randomize_va_space = 2

    checksec.sh --proc-all

    checksec.sh --fortify-proc 732
    * Process name (PID)                         : sshd (732)
    * FORTIFY_SOURCE support available (libc)    : Yes
    * Binary compiled with FORTIFY_SOURCE support: N

[1] - https://www.trapkit.de/tools/checksec/ # some Linux repositories already contain "checksec".

[2] - https://best.openssf.org/Compiler-Hardening-Guides/Compiler-...

[3] - https://news.ycombinator.com/item?id=43533516