🛡️ CVE-2026-42945 - NGINX Rift

Critical Heap-Based Buffer Overflow in NGINX

📌 Overview

CVE-2026-42945 (also known as NGINX Rift) is a critical security vulnerability in the ngx_http_rewrite_module of NGINX.

• Type: Heap-based Buffer Overflow (CWE-122)
• Discovered: May 2026
• Existed For: ~18 years
• Exploitable: Remotely, unauthenticated, via a single crafted HTTP request

The vulnerability arises from inconsistent buffer size calculation between the length-checking phase and the actual copy/escape phase when handling URI rewriting rules.

📋 Affected Versions

NGINX Open Source

NGINX Plus

Note: Many F5 NGINX products (Ingress Controller, App Protect, Gateway Fabric, etc.) are affected if running on vulnerable base versions.

🔍 Technical Details

The bug is triggered by a specific combination of directives:

1. A rewrite directive whose replacement string contains a ? (activates is_args flag).
2. Followed by another rewrite, if, or set directive that uses unnamed PCRE captures ($1, $2, etc.).

Root Cause

• The length calculation pass uses a zeroed sub-engine (is_args = false) → underestimates required buffer size.
• The copy/escape pass uses the real engine (is_args = true) → calls ngx_escape_uri() with NGX_ESCAPE_ARGS.
• Large numbers of escapable characters (+, &, %, etc.) in the URI cause heap overflow.

⚠️ Impact

CVSS v4.0 Score: 9.2 (Critical)
CVSS v3.1 Score: 8.1 (High)

🛠️ Mitigation & Fixes

1. Immediate Upgrade (Recommended)

• Update to NGINX 1.30.1 or 1.31.0+
• Update NGINX Plus to the latest patched release

2. Configuration Workaround

Replace unnamed captures with named captures:

Before (Vulnerable)

rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

After (Secure)

rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

Key Recommendation: Audit all rewrite rules that combine replacement strings containing ? and subsequent use of $1, $2, etc.

🛡️ Best Practices

• Always use named capture groups in production rewrite rules
• Keep NGINX and NGINX Plus regularly updated
• Monitor access logs for suspicious URI patterns
• Consider using WAF rules to detect exploitation attempts

📜 Summary

CVE-2026-42945 is one of the most significant NGINX vulnerabilities in recent years due to its long existence, ease of exploitation, and potential for RCE.

Act now — patch your instances and update your configurations.