chenqin231/cve-2026-42945Local risk assessment script for CVE-2026-42945 (nginx-rift). Checks version, vulnerable rewrite+set config, ASLR status, and compile hardening to determine actual RCE vs. DoS risk.
A local risk assessment tool for CVE-2026-42945 (Nginx Rift). Unlike simply telling you "version is affected so it's dangerous", this script checks the three conditions that truly determine risk layer by layer and gives a conclusion tailored to your actual situation.
CVE-2026-42945 is a heap buffer overflow vulnerability (CWE-122) in nginx's ngx_http_rewrite_module that existed for 18 years, with a CVSS 4.0 score of 9.2. However, the advisory contains a critical qualifier:
"Code execution possible on systems without ASLR protection"
RCE requires three conditions to be met simultaneously:
rewrite + set directivesIf any condition is missing, the worst case is a worker process crash and automatic restart (DoS), not server takeover.
Detailed analysis: The 18-year-old bomb in nginx: Did the 9.2-score vulnerability actually blow up your server?
# Run (requires sudo to read full nginx config)
sudo bash check_cve_2026_42945.sh
The script checks the following items in order; it exits early with a conclusion if any condition is not met:
| Check Item | Description |
|---|---|
| nginx version | Affected range: 0.6.27 – 1.30.0 |
| Vulnerability trigger configuration | Simultaneous presence of rewrite containing ? and capture group set inside the same location block |
| ASLR status | Read /proc/sys/kernel/randomize_va_space |
| Compilation hardening | Detection of -fcf-protection / FORTIFY_SOURCE / Full RELRO / stack protection |
Case 1: Version affected but no vulnerability trigger configuration (most common)
[*] nginx version: 1.24.0
[!] Version 1.24.0 is within the affected range, continuing to check trigger conditions...
[*] Scanning nginx configuration (checking rewrite+set vulnerability configuration combination)...
[✓] No vulnerability trigger configuration found (rewrite+set combination)
Conclusion: Version is affected but no trigger configuration exists, actual risk is extremely low
Recommendation: Plan upgrade to 1.30.1 / 1.31.0, no emergency action needed
Case 2: Vulnerability configuration present, ASLR enabled, compilation hardening complete
[!] Version 1.24.0 is within the affected range, continuing to check trigger conditions...
[!] Vulnerable trigger configuration found:
→ location ~ ^/api/(.*)$ {
[✓] ASLR is enabled (level 2, full randomization)
→ Prerequisites for reliable RCE exploitation not met, worst case is worker process crash (DoS)
[✓] Detected -fcf-protection (Intel CET control flow protection)
[✓] Detected FORTIFY_SOURCE=3
[✓] Detected Full RELRO (GOT read-only)
[✓] Detected stack protection (stack-protector)
Risk Level: Low
Recommendation: Upgrade to nginx 1.30.1 / 1.31.0 during next maintenance window
Case 3: Vulnerability configuration present, ASLR disabled
[!] Vulnerable trigger configuration found:
→ location ~ ^/api/(.*)$ {
[✗] ASLR is disabled! RCE risk significantly increased
Risk Level: High (DoS confirmed / RCE possible)
Immediate Actions:
1. Temporarily remove or modify the vulnerable rewrite+set configuration
2. Confirm ASLR is enabled: echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
3. Upgrade nginx: apt install nginx or compile and install 1.30.1+
| Level | Meaning | Recommended Response Timeline |
|---|---|---|
| No Impact | nginx not installed or version already fixed | No action needed |
| Extremely Low | Version affected but no trigger configuration | Upgrade during next routine maintenance |
| Low | Trigger configuration present, but ASLR + compilation hardening complete | Upgrade at next maintenance window |
| Medium | Trigger configuration present, protection gaps exist | Upgrade as soon as possible, availability at risk |
| High | Trigger configuration present + ASLR disabled + hardening missing | Immediate action |
| Product | Affected Versions | Fixed Versions |
|---|---|---|
| NGINX Open Source | 0.6.27 – 1.30.0 | 1.30.1 / 1.31.0 |
| NGINX Plus | R32 – R36 | R36 P4 / R35 P2 / R32 P6 |
# Ubuntu / Debian
sudo apt update && sudo apt install nginx
# Verify version
nginx -v
Official announcement: https://my.f5.com/manage/s/article/K000161019
The script has been verified in the following scenarios:
Test environment: Ubuntu 22.04 LTS, nginx 1.24.0 (Ubuntu official package)
include structures may be missed (the script expands all includes via nginx -T, covering the vast majority of cases)MIT