friparia/nginx_rift_scan_cve_2026_42945Nginx Rewrite CVE Scan(CVE-2026-42945 nginx-rift CVE-2026-9256)
Language: 中文 | English
This is a lightweight scanner for checking whether an NGINX configuration contains risky CVE-2026-42945, also known as NGINX Rift, and CVE-2026-9256 configuration patterns.
The issue was disclosed by depthfirst in NGINX Rift: Achieving NGINX RCE via an 18-Year-Old Vulnerability. Based on the article and F5/NVD descriptions, the risk depends on a specific ngx_http_rewrite_module configuration sequence: in the same configuration context, a rewrite replacement contains ?, and a following rewrite, if, or set references unnamed PCRE captures such as $1 or $2.
This tool looks for these high-risk patterns.
High-risk sequences like:
location ~ ^/api/(.*)$ {
rewrite ^/api/(.*)$ /internal?migrated=true;
set $original_endpoint $1;
}
The risk is not a standalone rewrite or set directive. The risky condition is the execution order inside the same context:
rewrite uses a regex capture and its replacement contains ?rewrite, if, or set uses unnamed capture variables such as $1 or $2This combination can cause inconsistent state between NGINX script length calculation and the actual copy phase, potentially leading to a heap buffer overflow.
High-risk rewrite directives like:
location / {
rewrite /wengine-auth-static/((.*)) /?$1$2 break;
}
Risk conditions:
$1 contains $2 in ^/((.*))$$1$2Note that break does not exclude the risk. If multiple overlapping captures appear after ?, the replacement still enters the arguments context. A plain URI rewrite such as /$1$2 break is not a triggering condition for this CVE.
When this pattern is found, the scanner explicitly reports CVE-2026-9256.
The depthfirst article lists the affected range as:
Use the official F5 advisory or your distribution security advisory as the source of truth for fixed versions and product-specific impact. Even when the version is in the affected range, the vulnerable configuration sequence is typically also required to trigger the issue.
The script prints both the current NGINX version and the configuration scan result:
0.6.27 - 1.30.1 and vulnerable config is found: upgrade NGINX or adjust the config.0.6.27 - 1.30.1 but vulnerable config is not found: upgrade is recommended, but this scanner did not find the triggering config pattern.Scan the full NGINX configuration on the current host:
python3 scan_rift.py
The script runs:
nginx -T
If the current user cannot read the full configuration, run it with sudo:
sudo python3 scan_rift.py
You can also scan an exported configuration file:
python3 scan_rift.py /path/to/nginx-full.conf
For example:
sudo nginx -T > nginx-full.conf
python3 scan_rift.py nginx-full.conf
When no vulnerable sequence is found:
--- NGINX Rift Config Scanner (CVE-2026-42945 / CVE-2026-9256) ---
Current NGINX Version: nginx version: nginx/1.23.3
Version Status: Affected version range for NGINX Open Source (0.6.27 - 1.30.1)
[+] No vulnerable CVE-2026-42945 sequences or CVE-2026-9256 patterns detected.
[Recommendation]: Current NGINX version is in the affected range, but no vulnerable config pattern was detected. Upgrade is recommended, but config risk was not found by this scanner.
When a suspicious sequence is found:
--- NGINX Rift Config Scanner (CVE-2026-42945 / CVE-2026-9256) ---
Current NGINX Version: nginx version: nginx/1.23.3
Version Status: Affected version range for NGINX Open Source (0.6.27 - 1.30.1)
[!] VULNERABLE SEQUENCE FOUND (CVE-2026-42945):
Context: location ~ ^/api/(.*)$ {
[1. Rewrite With ?] rewrite ^/api/(.*)$ /internal?migrated=true;
[2. Follow-up $N] set $original_endpoint $1;
[Action Required]: Current NGINX version is affected and vulnerable config was found. Upgrade NGINX or adjust the reported rewrite pattern.
When a suspicious CVE-2026-9256 pattern is found:
--- NGINX Rift Config Scanner (CVE-2026-42945 / CVE-2026-9256) ---
Current NGINX Version: nginx version: nginx/1.23.3
Version Status: Affected version range for NGINX Open Source (0.6.27 - 1.30.1)
[!] VULNERABLE PATTERN FOUND (CVE-2026-9256):
Context: location ^~ /wengine-auth-static/ {
[Rewrite Overlapping Captures] rewrite /wengine-auth-static/((.*)) /?$1$2 break;
[Context] arguments; overlapping refs: $1/$2
[Action Required]: Current NGINX version is affected and vulnerable config was found. Upgrade NGINX or adjust the reported rewrite pattern.
If the scanner reports a match, manually verify whether that configuration context is reachable by external requests, then upgrade NGINX or adjust the configuration.
rewrite / set combinations in location, server, if, and related contexts.$1 or $2 after a rewrite that contains ?.^/((.*))$ with ?$1$2.break as a mitigation for CVE-2026-9256; /?$1$2 break still matches.This is a static configuration scanner intended to quickly identify high-risk patterns. It is not an exploit validator.
include expansion, or dynamically generated configuration may affect scan quality.