CVE-2026-42945 – Critical Remote Code Execution in NGINX Rewrite Module

The newly disclosed CVE-2026-42945 is a Critical heap‑buffer overflow in the NGINX ngx_http_rewrite_module that enables remote code execution (RCE) with a single crafted HTTP request.

Key Takeaways

• Critical heap overflow in NGINX rewrite module (CVE‑2026‑42945)
• RCE possible with a single HTTP request; denial‑of‑service also observed
• Affects NGINX Open Source 0.6.27 – 1.30.0 and NGINX Plus releases
• Active exploitation reported in the wild; exploit code publicly available
• Immediate patch to NGINX 1.31.0/1.30.1 (or later) or disable vulnerable rewrite rules

Overview

In early May 2026, security researchers disclosed a long‑standing (≈18 years) flaw in the NGINX rewrite engine. The vulnerability, tracked as CVE-2026-42945, quickly attracted attention: by May 17, dozens of active‑exploitation reports were logged, and a public proof‑of‑concept (PoC) appeared on GitHub. The issue is being exploited in the wild, with threat‑intel feeds reporting hundreds of attempts per day.

Technical Details

The flaw resides in the handling of the rewrite directive when it is followed by a regular‑expression pattern that contains a question‑mark (?) and a specific PCRE construct. The processing chain allocates a heap buffer based on the pattern length, but fails to validate the final size after PCRE expands the pattern. An attacker can send a crafted request such as:

GET /?test=... HTTP/1.1
Host: vulnerable.example

where the query string triggers the vulnerable rewrite rule. The resulting heap‑buffer overflow corrupts the worker process memory, allowing:

• Remote Code Execution – arbitrary native code can be injected and executed with the privileges of the NGINX worker.
• Denial‑of‑Service – the overflow can also crash the worker, causing service interruption.

The exploit works without authentication and does not require any special headers; a single request is sufficient.

Severity & Impact

Active exploitation: The threat‑intel timeline shows 49 active‑exploitation reports on May 18, 32 on May 17, and continued activity through early June. Public PoCs and exploit‑tool kits are already circulating.

Affected Products

• NGINX Open Source 0.6.27 – 1.30.0
• NGINX Plus (all releases up to 1.30.0)
• NGINX Ingress Controller, NGINX WAF and other derivative packages that embed the vulnerable module.

For the exhaustive list of affected versions and downstream packages, see the live CVE page:

https://vulnsocial.com/cve/CVE-2026-42945

Actionable Insights – What to Monitor

1. Log inspection – search access logs for requests that hit rewrite rules containing a ? followed by complex regex patterns.
2. IDS/IPS signatures – enable signatures that detect the known PoC request pattern (e.g., unusually long query strings targeting rewrite locations).
3. Configuration audit – inventory all rewrite, if, and set directives; flag any that use PCRE with a ? quantifier.
4. Process monitoring – watch NGINX worker processes for unexpected crashes or restarts, a possible indicator of exploitation attempts.
5. Threat‑intel feeds – subscribe to real‑time alerts for CVE-2026-42945 on platforms such as VulnSocial.

Remediation & Mitigation

1. Patch immediately – upgrade to NGINX 1.31.0 or 1.30.1 (or any later release that includes the fix).
2. If patching is not feasible, disable the ngx_http_rewrite_module or remove/rewrite any vulnerable rewrite directives.
3. Apply vendor‑specific updates – for distributions that ship NGINX (e.g., Red Hat, AlmaLinux), install the security advisory packages as soon as they are released.
4. Deploy a Web Application Firewall to block the specific request pattern used by the PoC.
5. Rotate credentials and audit for any signs of post‑exploitation activity, especially if you suspect a breach.

Bottom Line

CVE-2026-42945 is a Critical heap‑overflow RCE in the NGINX rewrite module that is already being exploited at scale. The fastest path to safety is to apply the official patch (NGINX 1.31.0/1.30.1 or later). Where patching cannot be performed immediately, mitigate by removing or sanitizing vulnerable rewrite rules and hardening your perimeter defenses.

References

https://vulnsocial.com
https://vulnsocial.com/cve/CVE-2026-42945

#CVE #Critical #RCE #NGINX #CVE202642945