Scanner_CVE_2026-42945

Scanner for detecting Nginx instances vulnerable to CVE-2026-42945 (NGINX RIFT).
Accepts individual IPs, CIDR ranges, and ASNs as input.

About

CVE-2026-42945 affects all Nginx versions prior to 1.30.1.

The tool probes HTTP and HTTPS on default ports, reads the Server header from the response, and classifies each host as vulnerable, safe, or potentially affected (hidden version).

Results are saved to a log, with a list of hosts vulnerable to the CVE and a detailed .CSV file at the end.

Requirements

pip install requests packaging urllib3 dnspython

Usage

# Single IP
python nginx_scanner.py --ip 93.184.216.34

# CIDR range
python nginx_scanner.py --cidr 10.0.0.0/24

# Multiple CIDRs
python nginx_scanner.py --cidr 10.0.0.0/24 192.168.1.0/24

# ASN (originated prefixes resolved via RIPE Stat, fallback to bgp.tools)
python nginx_scanner.py --asn AS15169

# Combination of inputs
python nginx_scanner.py --asn AS13335 --cidr 10.0.0.0/8 --ip 1.2.3.4

# From a file (one IP, CIDR or ASN per line)
python nginx_scanner.py --file targets.txt

Example IP SCAN:

Example CIDR SCAN:

Example ASN SCAN:

Optional parameters

DNS resolution is executed in batch before the HTTP scan, using a dedicated thread queue (--dns-workers), preventing DNS latency from impacting scan performance.

Output

All results are written to ./logs/:

Status values

Remediation

Update Nginx to version 1.30.1 or higher using the official nginx.org repository.

# Ubuntu / Debian
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
  | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/mainline/ubuntu $(lsb_release -cs) nginx" \
  | tee /etc/apt/sources.list.d/nginx.list

echo -e "Package: *\nPin: origin nginx.org\nPin-Priority: 900" \
  | tee /etc/apt/preferences.d/99nginx

apt update && apt install --only-upgrade nginx
nginx -v

For other distributions, consult the official Nginx documentation.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42945
• Nginx changelog: https://nginx.org/en/CHANGES

Disclaimer

This script is intended for use on your own infrastructure or under explicit authorization.
Unauthorized scanning may violate various laws, so use with caution.

If you have any suggestions for feature improvements or bugs, feel free to open an issue and send me a Pull Request.

All contributions are welcome! 🚀🚀