nu0l/nginx-riftCVE-2026-42945 NGINX 堆溢出漏洞扫描与验证工具
NGINX Rift is an open-source scanning and verification tool targeting CVE-2026-42945 and CVE-2026-9256 (heap overflow vulnerabilities in NGINX ngx_http_rewrite_module). It supports remote network fingerprint scanning and local in-depth configuration auditing, helping security teams quickly identify potential risks in NGINX environments.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-9256 |
| Vulnerability Type | Heap-based Buffer Overflow (CWE-122) |
| Affected Component | NGINX ngx_http_rewrite_module |
| Affected Versions | NGINX open-source 0.1.17 ~ 1.31.0 (mainline) / 0.1.17 ~ 1.30.1 (stable) |
| Fixed Versions | NGINX 1.31.1 (mainline) / 1.30.2 (stable), released 2026-05-22 |
| Severity | High — can lead to denial of service (DoS); remote code execution (RCE) possible when ASLR is disabled |
Trigger Condition: The rewrite directive uses a PCRE regex with overlapping captures, and the replacement string references multiple unnamed capture groups.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-42945 |
| Vulnerability Type | Heap Overflow |
| Affected Component | NGINX ngx_http_rewrite_module |
| Affected Versions | NGINX open-source 0.6.27 ~ 1.30.0 / NGINX Plus R32 ~ R36 |
| Fixed Versions | NGINX 1.30.1 (stable) / 1.31.0 (mainline) / NGINX Plus R32 P6+ |
| Severity | High — can lead to denial of service (DoS) and remote code execution (RCE) |
Trigger Condition: The replacement URL in the rewrite directive contains both ? and a reference to an unnamed capture group (e.g., $1).
# CVE-2026-42945 trigger config: ? + $1
rewrite ^/api/(.*)$ /internal?id=$1 last;
# CVE-2026-9256 trigger config: multiple $N capture references
rewrite ^/(\w+)/(\d+)$ /$2/$1 last;
# Safe configuration (using named capture groups)
rewrite ^/api/(?<myid>.*)$ /internal?id=$myid last;
dpkg/rpm package managers to check if the distribution has backported patchesrewrite-target annotations in Kubernetes Ingress resourcesDownload the binary for your platform from the Releases page.
git clone https://github.com/nu0l/NGINX-Rift.git
cd NGINX-Rift
# Build for single platform
go build -o nginx_rift_scanner nginx_rift_scanner.go
# Cross-compile for all platforms
chmod +x build.sh && ./build.sh
./nginx_rift_scanner -h
# Scan a single target
./nginx_rift_scanner scan -u http://example.com
# Batch scan (read URL list from file)
./nginx_rift_scanner scan -f url.txt
url.txt should contain one URL per line, for example:
http://target1.com
https://target2.com
target3.com
# Automatically find default NGINX configuration paths
./nginx_rift_scanner verify
# Specify a configuration file path
./nginx_rift_scanner verify -p /etc/nginx/nginx.conf
Verify Mode performs a three-step audit:
nginx -v to obtain the version and checks OS package manager for backported patchesinclude directives) to identify dangerous rewrite ruleskubectl is detected, automatically scans all Ingress resources in the cluster| Priority | Solution | Description |
|---|---|---|
| P0 | Upgrade NGINX | Upgrade to NGINX 1.30.2+ (stable) / 1.31.1+ (mainline) / NGINX Plus latest security release |
| P0 | OS Package Manager Update | Run apt-get upgrade nginx or yum update nginx |
| P1 | Emergency Configuration Mitigation | Replace $1, $2, etc. in rewrite rules with named capture groups $name; no downtime required |
| P2 | K8s Ingress Fix | Upgrade the Ingress Controller and modify the rewrite-target annotation |
| P3 | Defense in Depth | Enable server_tokens off; to hide version fingerprinting |
NGINX-Rift/
├── nginx_rift_scanner.go # Main program source code
├── build.sh # Cross-platform compilation script
├── go.mod # Go module definition
└── README.md
net/http to send HTTP requests and parse the Server response headernginx/X.Y.Z) and commercial (NGINX Plus RXX) editions via regexinclude directives and using a visited map to prevent circular references? + $N (CVE-2026-42945) and multiple $N references (CVE-2026-9256)kubectl get ingress --all-namespaces -o yamldpkg-query/rpm --changelog to detect OS-level backported patches (searches for both CVE IDs)CGO_ENABLED=0) produces a standalone binary without C dependenciesMIT License
Contributed by the security community.