CVE-2026-42945 Security Detection Tool

This is a CVE-2026-42945 static detection tool for defense and internal network investigation, used to check whether there are high-risk rewrite combinations in NGINX ngx_http_rewrite_module related configurations.

This project does not provide exploit code, does not send malicious HTTP requests, and does not attempt to trigger crashes or remote code execution. It only reads local NGINX configuration files to help security teams determine whether an upgrade or configuration overhaul is needed.

Vulnerability Background

CVE-2026-42945 is a heap buffer overflow vulnerability in NGINX Open Source and NGINX Plus ngx_http_rewrite_module.

The risk scenarios described in the public advisory roughly include:

• There is a rewrite directive;
• Followed immediately by a rewrite, if, or set directive;
• Unnamed PCRE capture references are used in the configuration, e.g., $1, $2;
• The rewrite replacement string contains ?.

The fixed versions for NGINX Open Source include 1.30.1, 1.31.0 and later. For NGINX Plus, refer to the fixed versions in the vendor advisory.

Reference links:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42945
• F5 Advisory: https://my.f5.com/manage/s/article/K000161019
• oss-security mirror: https://seclists.org/oss-sec/2026/q2/519

Installation Requirements

Only Python 3 is required, no third-party dependencies.

python3 --version

Usage

It is recommended to first export the fully rendered NGINX configuration:

nginx -T > nginx-rendered.conf
python3 cve_2026_42945_checker.py nginx-rendered.conf

You can also directly scan the configuration directory:

python3 cve_2026_42945_checker.py /etc/nginx

Output JSON:

python3 cve_2026_42945_checker.py --json nginx-rendered.conf

If the exported configuration does not contain NGINX version information, you can manually specify the version for auxiliary judgment:

python3 cve_2026_42945_checker.py --json --nginx-version 1.30.0 nginx-rendered.conf

Output SARIF, convenient for importing into GitHub code scanning or internal security platforms:

python3 cve_2026_42945_checker.py --sarif nginx-rendered.conf > cve-2026-42945.sarif

Exit Codes

• 0: No high-risk configuration pattern found;
• 1: At least one high-risk configuration pattern found;
• 2: Failed to read input file or path.

Output Description

Key fields in the detection results include:

• versions: NGINX version identified from configuration or parameters and the judgment result;
• findings: Matched risk configuration locations, reasons, and evidence;
• summary: Number of scanned files, number of findings, and highest risk level.

Example risk results will indicate evidence like:

rewrite ... ?$1; -> set ... $1;

This indicates that the configuration pattern is similar to the risk conditions described in the public advisory and requires priority review.

Remediation Suggestions

Prioritize upgrading NGINX to a fixed version:

• NGINX Open Source 1.30.1, 1.31.0 or later;
• NGINX Plus: use the fixed version from the vendor advisory.

At the same time, it is recommended to review rewrite rules:

• Try to avoid relying on unnamed capture references like $1, $2;
• Prefer using named captures;
• Simplify consecutive rewrite, if, set combinations;
• Scan with the full configuration exported by nginx -T before external release.

Limitations

This tool is a static configuration detector, not a full vulnerability validator. It may not cover:

• Configuration dynamically generated at runtime;
• Include files not included in the scan path;
• Vendor backport patches;
• Differences related to actual traffic, compilation parameters, and runtime environment.

Please use it as an auxiliary tool for internal investigation and configuration auditing, not as the sole basis for vulnerability assessment.

Development

Run tests:

python -m pytest

The repository already contains a GitHub Actions workflow that will automatically run tests on push and pull requests.