webdev75950-ux/nginx-rce-cve-2026-42945Proof-of-concept exploit for CVE-2026-42945, a critical heap buffer overflow in NGINX rewrite module enabling remote code execution via crafted URI requests.
A heap buffer overflow in NGINX's ngx_http_rewrite_module component that was introduced in 2008 -- meaning it existed for 16 years before discovery.
The vulnerability is in the two-pass script engine:
The problem: internal engine state changes between the two passes. When a rewrite replacement contains a (question mark), an causes an undersized buffer allocation, allowing attacker-controlled escaped URI data to overflow the heap boundary.
?# Conceptual: padding request URI with '+' signs forces
# the escaping function to expand each byte into three bytes,
# overflowing the allocated chunk. The overflow size is
# fully controlled by the number of escapable characters.
To achieve RCE (bypassing ASLR):
ngx_pool_t cleanup pointerngx_pool_cleanup_s invoking system() on pool destructionRelated CVEs discovered by the same system: CVE-2026-42946, CVE-2026-40701, CVE-2026-42934
DepthFirstDisclosures/Nginx-Rift on GitHubThis vulnerability was autonomously discovered by DepthFirst's security analysis system after a single click of onboarding the NGINX source code -- highlighting the power of automated vulnerability discovery.
? in replacements