18-Year-Old NGINX Rewrite Flaw Could Enable Unauthenticated RCE
Summary
F5 disclosed an 18-year-old heap overflow in NGINX’s rewrite module, which crafted HTTP requests can trigger without authentication, potentially causing remote code execution or worker crashes. F5 also patched three other flaws and recommends upgrades or a configuration
Key points
- CVE-2026-42945, named NGINX Rift, is a heap buffer overflow in ngx_http_rewrite_module.
- An unauthenticated attacker can trigger the flaw with crafted HTTP requests when affected rewrite directives use unnamed regex captures and a replacement string containing a question mark.
- The flaw can crash or restart NGINX workers; F5 says code execution is possible on systems with ASLR disabled.
- Affected NGINX versions have fixes in NGINX Plus R32 P6 and R36 P4, and NGINX Open Source 1.30.1 and 1.31.0; no fixes are planned for versions 0.6.27–0.9.7.
- F5 also patched CVE-2026-42946, CVE-2026-40701, and CVE-2026-42934, affecting other NGINX modules.
- If CVE-2026-42945 cannot be patched immediately, F5 advises replacing unnamed regex captures with named captures in affected rewrite directives.
Article Details
- Vulnerability Types
- Heap buffer overflow
- Excessive memory allocation
- Use-after-free
- Out-of-bounds read
- Severity
- Critical; CVE-2026-42945 has a CVSS v4 score of 9.2.
- Affected Versions
- NGINX Plus R32–R36
- NGINX Open Source 1.0.0–1.30.0
- NGINX Open Source 0.6.27–0.9.7
- NGINX Instance Manager 2.16.0–2.21.1
- F5 WAF for NGINX 5.9.0–5.12.1
- NGINX App Protect WAF 4.9.0–4.16.0
- NGINX App Protect WAF 5.1.0–5.8.0
- F5 DoS for NGINX 4.8.0
- NGINX App Protect DoS 4.3.0–4.7.0
- NGINX Gateway Fabric 1.3.0–1.6.2
- NGINX Gateway Fabric 2.0.0–2.5.1
- NGINX Ingress Controller 3.5.0–3.7.2
- NGINX Ingress Controller 4.0.0–4.0.1
- NGINX Ingress Controller 5.0.0–5.4.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- For CVE-2026-42945, replace unnamed captures with named captures in every affected rewrite directive.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker can send crafted HTTP requests to exploit the vulnerable NGINX rewrite module.T1499.004 · Application or System ExploitationRepeated crafted requests can crash NGINX workers and degrade availability for sites served by the instance.
CVE
CVE-2026-40701F5 · NGINX Open Source; F5 · NGINX PlusCVE-2026-40701 (CVSS v4 score: 6.3) – A use-after-free vulnerability in the ngx_http_ssl_module module that could allow a remote, unauthenticated attacker to have limited control of modification of data or restart theCVE-2026-42934F5 · NGINX Open Source; F5 · NGINX PlusCVE-2026-42934 (CVSS v4 score: 6.3) – An out-of-bounds read vulnerability in the ngx_http_charset_module module that could allow a remote, unauthenticated attacker to disclose memory contents or restart the NGINX workerCVE-2026-42945F5 · NGINX Open Source; F5 · NGINX Plus; +21 moreThe flaw is tracked as CVE-2026-42945 and codenamed NGINX Rift.CVE-2026-42946F5 · NGINX Open Source; F5 · NGINX PlusCVE-2026-42946 (CVSS v4 score: 8.3) – An excessive memory allocation vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that could allow a remote, unauthenticated attacker with
Vendors
Products
F5 DoS for NGINXF5 DoS for NGINX 4.8.0F5 WAF for NGINXF5 WAF for NGINX 5.9.0 – 5.12.1NGINX App Protect DoSNGINX App Protect DoS 4.3.0 – 4.7.0NGINX App Protect WAFNGINX App Protect WAF 4.9.0 – 4.16.0NGINX Gateway FabricNGINX Gateway Fabric 1.3.0 – 1.6.2NGINX Ingress ControllerNGINX Ingress Controller 3.5.0 – 3.7.2NGINX Instance ManagerNGINX Instance Manager 2.16.0 – 2.21.1NGINX Open SourceF5 also patched three additional vulnerabilities across NGINX Plus and NGINX Open Source, and advised users to upgrade or replace unnamed regex captures with named captures where needed.NGINX PlusF5 also patched three additional vulnerabilities across NGINX Plus and NGINX Open Source, and advised users to upgrade or replace unnamed regex captures with named captures where needed.