Though I have done the following setting, and even restarted the server:
# head /etc/security/limits.conf -n2
www-data soft nofile -1
www-data hard nofile -1
# /
I found the answer in few minutes after posting this question...
# cat /etc/default/nginx
# Note: You may want to look at the following page before setting the ULIMIT.
# http://wiki.nginx.org/CoreModule#worker_rlimit_nofile
# Set the ulimit variable if you need defaults to change.
# Example: ULIMIT="-n 4096"
ULIMIT="-n 15000"
/etc/security/limit.conf
is used by PAM, so it shoud be nothing to do with www-data
(it's nologin user).