CVE-2026-42945 - NGINX Rift Vulnerability Analysis and Reproduction

Overview

CVE-2026-42945 (codename "NGINX Rift") is a heap buffer overflow vulnerability in the NGINX ngx_http_rewrite_module, with a CVSS v4 score of 9.2 (Critical).

Discovered by the depthfirst security research team in April 2026, this vulnerability has been latent for 18 years since its introduction in NGINX version 0.6.27 in 2008.

Affected Versions

• NGINX Open Source 0.6.27 ~ 1.30.0
• NGINX Plus R32 ~ R36
• NGINX Instance Manager 2.16.0 ~ 2.21.1
• F5 WAF for NGINX 5.9.0 ~ 5.12.1
• NGINX App Protect WAF 4.9.0 ~ 4.16.0 and 5.1.0 ~ 5.8.0
• NGINX Gateway Fabric 1.3.0 ~ 1.6.2 and 2.0.0 ~ 2.5.1
• NGINX Ingress Controller 3.5.0 ~ 3.7.2, 4.0.0 ~ 4.0.1, 5.0.0 ~ 5.4.1

Fixed Versions

• NGINX 1.31.0 (released on May 13, 2026)

Trigger Conditions

The vulnerability requires the following NGINX configuration pattern to be triggered:

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;
    set $original_endpoint $1;
}

Key conditions:

1. The replacement string in the rewrite directive contains ? (question mark)
2. A subsequent set directive references a regular expression capture group (e.g., $1)
3. The request URI contains escapable characters (such as +, &, %, etc.)

Root Cause Analysis

Two-phase Processing of the Script Engine

NGINX's script engine uses two-phase processing to execute rewrite/set directives:

1. Phase 1 (length calculation): Calculate the memory size required for the final string
2. Phase 2 (data copy): Write the actual data into the allocated buffer

State Inconsistency Leading to Overflow

The core of the vulnerability lies in the engine state inconsistency between the two phases:

Phase 1: rewrite sets the is_args flag

When the rewrite directive's replacement string contains ?, the ngx_http_script_start_args_code function sets:

void ngx_http_script_start_args_code(ngx_http_script_engine_t *e)
{
    e->is_args = 1;  // Permanently set, never reset!
    e->args = e->pos;
    e->ip += sizeof(uintptr_t);
}

Phase 2: Length calculation for the set directive uses a fresh sub-engine

When a subsequent set directive references a capture group, ngx_http_script_complex_value_code creates a zeroed sub-engine:

void ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
{
    ngx_http_script_engine_t le;
    // ...
    ngx_memzero(&le, sizeof(ngx_http_script_engine_t)); // le.is_args = 0
    le.ip = code->lengths->elts;

Phase 3: Divergence between length calculation and actual copy

Length calculation (using sub-engine le, is_args=0):

// ngx_http_script_copy_capture_len_code
if ((e->is_args || e->quote) && (e->request->quoted_uri || e->request->plus_in_uri))
{
    // is_args=0, condition is false, goes to else branch
    return cap[n + 1] - cap[n];  // Returns raw length (unescaped)
}

Actual copy (using main engine e, is_args=1):

// ngx_http_script_copy_capture_code
if ((e->is_args || e->quote) && (e->request->quoted_uri || e->request->plus_in_uri))
{
    // is_args=1, condition is true, goes to if branch
    e->pos = (u_char *) ngx_escape_uri(pos, &p[cap[n]],
                                        cap[n + 1] - cap[n],
                                        NGX_ESCAPE_ARGS);
    // Each escapable character expands from 1 byte to 3 bytes!
}

Overflow Size

• Allocated buffer size: raw_size (raw capture length)
• Actual written size: raw_size + 2 * N (N = number of escapable characters)
• Overflow amount = 2 * N bytes

For example, if the URI contains 100 + signs, the overflow is 200 bytes.

Exploitation Methods

1. DoS (Denial of Service)

Simplest exploitation - sending a request containing many escapable characters causes the worker process to crash:

GET /api/+++++++++++++++++++++++++++++++++++ HTTP/1.1
Host: target.com

2. RCE (Remote Code Execution)

Full RCE exploit chain (requires ASLR disabled or bypassed):

1. Heap layout control: Control the heap layout of ngx_pool_t through connection ordering
2. Overflow to overwrite cleanup pointer: Overflow into the adjacent memory pool structure
3. Spray fake cleanup structures: Inject forged structures containing the system() address through POST request body
4. Trigger execution: Close the victim connection, triggering ngx_destroy_pool to traverse the cleanup linked list

NGINX's multi-process architecture makes exploitation more reliable - after a worker crash, the master forks a new worker with the identical memory layout.

File Description

• README.md - This file, vulnerability analysis document
• Dockerfile - Build a vulnerable NGINX environment
• nginx.conf - NGINX configuration to trigger the vulnerability
• poc_crash.py - DoS PoC (triggers worker crash)
• docker-compose.yml - One-click startup of the test environment

Quick Reproduction

# 1. Build and start the vulnerable NGINX
docker-compose up -d

# 2. Run DoS PoC
python3 poc_crash.py

# 3. Check NGINX error log to confirm crash
docker-compose logs nginx

References

• NGINX official CHANGES - Fix announcement
• depthfirst research report - Technical analysis by the original discoverer
• F5 Security Advisory K000160932 - Official security advisory

Disclaimer

This material is intended for security research and educational purposes only. Do not use this information for unauthorized attacks.