CVE-2026-42945: NGINX Rift Heap Buffer Overflow Vulnerability

Overview

CVE-2026-42945 is a critical heap buffer overflow vulnerability in the NGINX server, known as "NGINX Rift". The vulnerability exists in the processing logic of the rewrite and set directives in NGINX. When specific configuration conditions are met, an attacker can trigger a heap overflow by crafting a malicious request, leading to denial of service (DoS) and potentially remote code execution (RCE).

Vulnerability Type: Heap Buffer Overflow Risk Level: High CVE ID: CVE-2026-42945

Affected Versions

• Affected Versions: NGINX 0.6.27 ~ 1.30.0
• Unaffected Versions: NGINX 1.31.0 and later

Fixed Versions

It is recommended to upgrade immediately to one of the following versions:

• NGINX 1.31.0 or later stable version
• Security patch versions provided by distribution vendors

Trigger Conditions

The vulnerability is triggered by simultaneously satisfying the following two conditions:

1. Configuration Condition: NGINX configuration uses both:

   • rewrite directive (the replacement string contains the ? character)
   • set directive (references rewrite regex capture groups like $1, $2)

2. Request Condition: The request URI contains escapable characters (such as +, &, %, etc.)

Principle Explanation:

• The rewrite directive sets e->is_args = 1 (never reset)
• The length calculation stage of the set directive uses a zeroed sub-engine (le.is_args = 0)
• NGINX decodes %25 to %, but ngx_escape_uri re-encodes it as %25 (3 bytes)
• Each %25 character expands from 1 byte to 3 bytes, causing writes beyond the buffer boundary

Exploitation

PoC Testing

# 使用项目中的测试脚本
python3 CVE-2026-42945/CVE-2026-42945-test.py --host cve.test.com --port 80

Vulnerability Verification Process

1. Send a normal request to confirm the server's running status.
2. Send a request containing a small number of %25 characters for a small-scale test.
3. Send a large number of %25 characters (e.g., 2000) to trigger the buffer overflow.
4. Check whether the server crashes or returns an abnormal response (500/502 error).
5. Check whether the server automatically recovers (master process forks a new worker).

Test Results Analysis

Single-Layer Architecture POC Results

In a single-layer NGINX configuration, the test results will trigger the vulnerability:

Crash Log Analysis:

• The worker process crashes due to SIGSEGV (signal).
• The crash occurs in the ngx_http_script_flush_no_cacheable_variables function.
• Crash phase: ngx_http_core_rewrite_phase.

Double-Layer Architecture POC Results

In a double-layer NGINX configuration (layer1 forwarding + layer2 service), the test results are as follows:

File Descriptions

References

• NGINX Official Security Advisory
• CVE-2026-42945 MITRE Details
• NVD - CVE-2026-42945

Disclaimer

This project is for security research and educational purposes only. Users must comply with the laws and regulations of their respective countries and regions. The authors are not responsible for any unauthorized misuse.

Prohibited for illegal attacks!

Last Updated: 2026-05-19