CVE-2026-42945: NGINX rewrite module heap buffer overflow via crafted HTTP requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 4.0 score of 9.2 with network reachability, no authentication required, high confidentiality/integrity/availability impact, and a public exploit reference.

What it is

NGINX Plus and NGINX Open Source contain a heap buffer overflow in the ngx_http_rewrite_module when a rewrite directive is followed by another rewrite, if, or set directive and an unnamed PCRE capture (such as $1) is used in a replacement string containing a question mark. An unauthenticated attacker can trigger the overflow with crafted HTTP requests, crashing the worker process and potentially executing code where ASLR is disabled or bypassable.

Impact

Attackers can crash or restart NGINX worker processes, causing denial of service, and may achieve code execution on systems with ASLR disabled or bypassable.

Attack surface

Reachable over the network via crafted HTTP requests to servers whose configuration uses the affected rewrite/if/set pattern with unnamed PCRE captures and a question mark in the replacement string. No authentication or user interaction is required, though exploitation depends on conditions beyond the attacker's control.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.68 probability, 99.3rd percentile) and a public exploit reference exists (DepthFirstDisclosures/Nginx-Rift), indicating active interest and available proof-of-concept code.

What to do

• Apply the vendor patch or upgrade to a fixed NGINX Plus / NGINX Open Source release per F5 advisory K000161019 and Red Hat errata.
• Audit nginx configurations for rewrite directives followed by rewrite, if, or set that use unnamed PCRE captures ($1, $2) with a question mark in the replacement string, and rewrite them to avoid the pattern.
• Enable ASLR on all hosts running NGINX to reduce the chance of code execution from the overflow.
• Restrict or monitor external access to NGINX endpoints that use affected rewrite configurations until patching is complete.

Detection

• Monitor NGINX worker process crashes, unexpected restarts, or core dumps correlated with HTTP request bursts.
• Inspect HTTP request logs for requests targeting URIs that exercise rewrite rules with unnamed captures and question-mark replacements.
• Alert on repeated 5xx responses or connection resets from NGINX instances running affected configurations.
• Track EPSS and vendor advisories for updated exploitation status and patch guidance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.