chamsbouzaiene/ai-vuln-rediscovery-nginx-cve-2026-42945Reproducible AI-assisted vulnerability rediscovery of CVE-2026-42945 in nginx, including technical analysis, PoC trigger, and patch validation for heap buffer overflow.
This repository documents a reproducible AI-assisted vulnerability rediscovery experiment against nginx ngx_http_rewrite_module, later associated with CVE-2026-42945.
The experiment is intentionally narrow. The vulnerable file, src/http/ngx_http_script.c, was provided directly to the model for audit. This is not a claim that an AI system autonomously found the issue in the full nginx codebase from scratch.
The audited bug is a heap buffer overflow caused by stale script-engine state in nginx rewrite processing.
At a high level:
rewrite replacement containing ? sets e->is_args = 1.e->is_args is not cleared after the rewrite finishes.set, , or rewrite expression that copies an unnamed regex capture, such as , can size the destination buffer as if the capture will be copied raw.if$1e->is_args = 1 and URI-escapes the capture.The local AddressSanitizer reproduction confirms a heap-buffer-overflow in:
ngx_escape_uri
ngx_http_script_copy_capture_code
ngx_http_rewrite_handler
.
├── README.md
├── LICENSE
├── prompts/
│ ├── audit_prompt.md
│ └── poc_prompt.md
├── poc/
│ ├── trigger.py
│ ├── nginx.conf
│ ├── reproduce.sh
│ └── expected_output.txt
├── docs/
│ ├── technical-analysis.md
│ ├── vulnerability-breakdown.md
│ └── methodology.md
└── screenshots/
└── asan-crash.png
The PoC is designed for a local lab build of vulnerable nginx with AddressSanitizer enabled. It starts nginx on 127.0.0.1:18080, sends a crafted request to a local server, and prints crash evidence.
Use an affected nginx source tree. The experiment was validated against nginx 1.30.0 built with clang and ASan:
./auto/configure \
--prefix=/tmp/nginx-asan-poc \
--with-cc-opt='-O0 -g -fsanitize=address -fno-omit-frame-pointer' \
--with-ld-opt='-fsanitize=address'
make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu)"
From this repository:
NGINX_BIN=/path/to/vulnerable/nginx/objs/nginx ./poc/reproduce.sh
If this repository is placed directly inside the nginx source checkout used for validation, the script also finds ../../objs/nginx automatically.
A successful reproduction prints an ASan report similar to:
ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1
#0 ngx_escape_uri ngx_string.c:1687
#1 ngx_http_script_copy_capture_code ngx_http_script.c:1399
#2 ngx_http_rewrite_handler ngx_http_rewrite_module.c:180
The nginx config used by the PoC is intentionally small:
location / {
rewrite ^(.*) /new?c=1;
set $myvar $1;
return 200 "$myvar\n";
}
The first rewrite sets e->is_args because the replacement contains ?. The later set evaluates $1 while that stale state is still present.
The minimal patch resets the script engine's argument-state flag when a regex rewrite finishes:
e->is_args = 0;
e->quote = 0;
In the source tree used for this experiment, the fix appears as commit:
524977e7c534e87e5b55739fa74601c9f1102686
Rewrite: fixed escaping and possible buffer overrun
The key point is not the size of the patch, but the state invariant it restores: the length pass and the write pass must agree on whether captures are being copied as URI arguments.
This experiment used a frontier coding agent as an audit assistant. The prompt explicitly directed the model to focus on memory-safety issues in src/http/ngx_http_script.c and to pay close attention to two-pass length/write mismatches.
Important limitations:
The exact prompts are included in prompts/audit_prompt.md and prompts/poc_prompt.md.
This repository is intended for defensive research, patch validation, and reproducibility. Run the PoC only against local lab instances you control.
The documentation and PoC harness in this repository are released under the MIT License. nginx itself is not included and is governed by its own license.