byezero/nginx-cve-2026-42945-checkLocal read-only scanner for CVE-2026-42945 (NGINX Rift) that checks NGINX, OpenResty, and Tengine instances for vulnerable rewrite configurations without executing exploits or modifying services.
This repository provides two standalone local scripts for checking whether a Linux or Windows server has Nginx, OpenResty, or Tengine instances that may be exposed to CVE-2026-42945 related risk.
The scripts are read-only. They do not run an exploit, do not send attack requests, do not modify configuration, do not restart services, and do not upgrade software.
CVE-2026-42945, also known as NGINX Rift, is publicly described as a heap-based buffer overflow in ngx_http_rewrite_module. According to the NVD description, the vulnerable condition involves a rewrite directive followed by a rewrite, if, or set directive, unnamed PCRE capture variables such as $1 or , and a replacement string that includes a question mark . A remote unauthenticated attacker may trigger the condition with crafted HTTP requests, causing an NGINX worker process heap buffer overflow. The impact may include worker process restarts, and code execution may be possible on systems where ASLR is disabled.
$2?The official NGINX security advisory lists the NGINX Open Source fixed and affected boundaries as follows:
| Status | NGINX Open Source versions |
|---|---|
| Fixed | 1.31.0+ / 1.30.1+ |
| Potentially affected | 0.6.27-1.30.0 |
Linux distributions, commercial products, OpenResty, Tengine, and private builds may have backported patches or product-specific version mapping. The scripts collect local evidence, but vendor advisories should be used for final confirmation.
This is not an exploitation or PoC tool. It is a local evidence collector and static configuration checker. It focuses on the following pattern:
rewrite directive replacement string uses an unescaped unnamed capture variable such as $1 or $2.rewrite replacement string contains an unescaped ?. A literal escaped \? is not treated as a risk condition.rewrite, if, or set directive exists in the same configuration scope.Example risk pattern:
location ~ ^/api/(.*)$ {
rewrite ^/api/(.*)$ /internal?endpoint=$1 last;
set $flag 1;
}
The risk is not a single rewrite or set directive by itself. Version, effective configuration context, and directive order all matter. When a match is reported, manually confirm whether the configuration is active, reachable by external requests, and already fixed by a vendor backport.
| File | Description |
|---|---|
check_nginx_linux.sh | Local Linux checker |
check_nginx_windows.ps1 | Local Windows checker |
README.md | Chinese README |
README.en.md | English README |
Supported in this version:
rewrite patterns.summary.txt, summary.json, and raw evidence files.Not included in this version:
Run with administrative privileges when possible:
root or an account with sudo privileges.The scripts will still try to collect evidence without administrative privileges. If the effective nginx -T configuration cannot be exported, the result is marked as 需人工复核 (manual review required).
Upload check_nginx_linux.sh to the target server and run:
chmod +x check_nginx_linux.sh
sudo ./check_nginx_linux.sh
If sudo is unavailable, you can run:
./check_nginx_linux.sh
Upload check_nginx_windows.ps1 to the target server and run it from an elevated PowerShell:
powershell -ExecutionPolicy Bypass -File .\check_nginx_windows.ps1
The script creates a result directory next to the script. The directory name includes hostname, timestamp, and process ID to avoid evidence mixing when the script is run multiple times in the same second.
nginx_check_<hostname>_<timestamp>_<pid>/
summary.txt
summary.json
raw/
host_info.txt
process_info.txt
service_info.txt
package_info.txt
nginx_paths.txt
instances/
instance_01/
nginx_invocation.txt
nginx_version.txt
nginx_build.txt
nginx_config_dump.txt
risky_config_matches.txt
instance_02/
...
| File or directory | Description |
|---|---|
summary.txt | Human-readable Chinese summary |
summary.json | Structured output for later aggregation |
raw/ | Raw command output and evidence files |
raw/instances/instance_XX/ | Per-instance version, configuration, and risk evidence |
Important summary fields:
| Field | Description |
|---|---|
实例数量 | Number of local Nginx / OpenResty / Tengine candidate instances checked |
配置大小 | Size of the raw nginx -T configuration dump |
扫描行数 | Number of configuration dump lines scanned |
危险配置命中数量 | Number of risky rewrite matches |
证据摘要 | Evidence preview for the highest-risk instance |
Large configurations are not printed to the console. The full effective configuration is saved as nginx_config_dump.txt under each instance directory. If a configuration dump is larger than 10 MB, the script continues scanning and recommends manual sampling of the raw evidence.
If multiple nginx, openresty, or tengine candidate executables are found, the scripts check each one and write per-instance evidence.
The top-level conclusion uses the highest-risk instance. The conservative priority order is:
受影响有风险配置 (affected with risky configuration)需人工复核 (manual review required)受影响无风险配置 (affected version, no risky configuration found)不受影响 (not affected)未安装Nginx (Nginx not found)需人工复核 is ranked above 受影响无风险配置 because an unknown or incomplete instance should not be hidden by another instance whose configuration was successfully checked.
| Conclusion | Meaning |
|---|---|
未安装Nginx | No Nginx / OpenResty / Tengine command, process, or service was found |
不受影响 | A fixed version was found and no risky configuration was detected |
受影响无风险配置 | The version may be affected, but no risky rewrite pattern was detected |
受影响有风险配置 | The version may be affected, or the derivative version needs review, and a risky rewrite pattern was detected |
需人工复核 | Unknown version, derivative build, incomplete configuration collection, insufficient privilege, or insufficient evidence |
| Product | Version assessment |
|---|---|
NGINX 1.31.0+ | Fixed, reported as 已修复(mainline) |
NGINX 1.30.1+ | Fixed, reported as 已修复(stable) |
NGINX 0.6.27-1.30.0 | Potentially affected |
| OpenResty / Tengine | Version and configuration are collected, but impact mapping requires manual review |
Distribution packages may have backported patches while keeping older upstream version strings. Use summary.txt and package evidence together with vendor advisories for final confirmation.
rewrite, if, and set combinations under all location, server, and if scopes.$1 or $2 in rewrite replacement strings that contain ?.nginx -T cannot export the full effective configuration, the scripts do not mark the host as safe.