Skip to main content

NGINX Plus and NGINX Open Source CVE-2026-42945

| EUVDEUVD-2026-30010 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-05-13 f5 GHSA-gcgv-v5gf-c543
RCE Buffer Overflow Heap Overflow Nginx Nginx Open Source Nginx Plus F5
9.2
CVSS 4.0 · Vendor: f5
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Recon vulnerable rewrite config
  2. Delivery
    Craft malicious HTTP request
  3. Exploit
    Trigger PCRE capture processing
  4. Execution
    Overflow heap buffer in worker
  5. Persist
    Crash process or execute code
  6. Impact
    Achieve system compromise

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires NGINX configuration with ngx_http_rewrite_module using a rewrite directive immediately followed by another rewrite, if, or set directive where unnamed PCRE capture variables ($1, $2, etc.) appear in replacement strings containing question mark characters. Example vulnerable pattern: 'rewrite ^/(.*)$ /path/$1?param=value; set $var $1;'. Additionally requires attacker-crafted HTTP requests triggering the vulnerable code path combined with unspecified conditions beyond attacker control (likely server-side state, timing, or resource conditions not detailed in available data). Remote unauthenticated exploitation is possible (AV:N/PR:N) but high attack complexity (AC:H) reflects the multiple prerequisites. Systems with ASLR enabled limit impact to denial-of-service, while ASLR-disabled systems face code execution risk. Default NGINX installations without custom rewrite rules using PCRE captures are not exploitable.
Impact

The CVSS 4.0 score of 9.2 reflects maximum confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N) and no authentication required (PR:N). However, the high attack complexity (AC:H) and explicit requirement for conditions beyond attacker control significantly constrain real-world exploitability. The vulnerability demands three prerequisites: specific ngx_http_rewrite_module directive chaining, PCRE capture usage with question marks in replacement strings, and exploitable server-side conditions. These requirements explain why no CISA KEV listing or public exploit exists despite the critical CVSS rating. The ASLR dependency creates a two-tier risk profile: modern hardened systems face denial-of-service only, while legacy or embedded systems without ASLR face remote code execution. Organizations must prioritize patching based on their specific rewrite directive configurations and ASLR deployment status rather than CVSS score alone. The phrase 'conditions beyond attacker control' in the description suggests race conditions, timing dependencies, or server state requirements that further reduce exploitation reliability.
Exploit ScenarioDerived

An unauthenticated remote attacker identifies an NGINX server using rewrite directives with PCRE captures in the configuration (common in URL normalization and routing rules). The attacker sends specially crafted HTTP requests with payloads designed to trigger heap buffer overflow conditions during URI rewriting. On systems without ASLR, the attacker leverages the overflow to overwrite adjacent heap metadata and inject shellcode, achieving remote code execution in the NGINX worker process context. On ASLR-enabled systems, repeated exploitation causes worker process crashes leading to service degradation. No public exploit identified at time of analysis, though the vulnerability's specificity suggests targeted exploitation against known NGINX configurations rather than automated scanning campaigns.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – May 13, 2026

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker processes and potentially execute code on systems without ASLR. The vulnerability requires specific rewrite directive configurations using PCRE captures with question marks in replacement strings, combined with attacker-crafted HTTP requests and conditions beyond the attacker's control. F5 has released patches addressing this critical flaw. EPSS data unavailable; no KEV listing or public exploit identified at time of analysis, though the specific configuration requirements and dependency on external conditions likely limit widespread exploitation despite the 9.2 CVSS score.

Earlier versions of this analysis (1)
v1 May 13, 2026 - 15:51 CVSS 8.1

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote unauthenticated attackers to crash worker processes and potentially achieve code execution on systems with ASLR disabled. The vulnerability requires specific rewrite directive configurations using unnamed PCRE captures ($1, $2) with question marks in replacement strings - a condition outside direct attacker control. F5 has released patches addressing this vulnerability. EPSS data not provided; no KEV listing or public POC identified at time of analysis, suggesting limited active exploitation despite network-reachable attack vector.

RemediationAI

Apply vendor-released patches immediately per F5 advisory K000161019 available at https://my.f5.com/manage/s/article/K000161019. Exact patched versions are not specified in available data; consult the F5 advisory for version-specific upgrade paths. For environments unable to patch immediately, implement the following compensating controls with noted trade-offs: audit all NGINX configurations for rewrite directives followed by rewrite/if/set directives using unnamed PCRE captures ($1-$9) with question marks in replacement strings, and rewrite these to use named captures or eliminate question marks (may require application changes to URI handling logic); deploy or verify ASLR is enabled on all NGINX host systems to limit exploitation from code execution to denial-of-service only (standard on modern Linux kernels but may conflict with legacy application compatibility requirements); implement rate limiting and request validation at upstream load balancers to reduce attack surface for crafted HTTP requests (adds latency and may block legitimate edge-case requests). Configuration audits can be automated via 'grep -r rewrite /etc/nginx/' combined with regex pattern matching for vulnerable directive sequences.

Affected VersionsENISA

NGINX Plus R36 <R36 P4
NGINX Plus R32 <R32 P6
NGINX Open Source 0.6.27 <1.30.1

Affected Packages

euvd nginx_open_source fix: 1.30.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the ngx_http_rewrite_module, a core NGINX module that manipulates request URIs using Perl-Compatible Regular Expressions (PCRE). The flaw (CWE-122: Heap-based Buffer Overflow) occurs when the rewrite directive chains with subsequent rewrite, if, or set directives while using unnamed PCRE capture groups ($1, $2, etc.) in replacement strings containing question marks. The heap overflow manifests during request processing when the module incorrectly calculates buffer sizes for URI manipulation. On systems with Address Space Layout Randomization (ASLR) enabled, exploitation is limited to denial-of-service via worker process crashes. However, ASLR-disabled systems face remote code execution risk as attackers can predict memory layouts to hijack control flow. Both NGINX Plus (commercial) and NGINX Open Source are affected according to CPE data cpe:2.3:a:f5:nginx_plus and cpe:2.3:a:f5:nginx_open_source, indicating widespread exposure across F5's NGINX product line.

Know when Nginx Plus gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 9.2 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 CRITICAL

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
Severity Changed
May 13, 2026 - 16:22 NVD
HIGH CRITICAL
CVSS changed
May 13, 2026 - 16:22 NVD
8.1 (HIGH) 9.2 (CRITICAL)
CVE Published
May 13, 2026 - 14:12 nvd
HIGH 8.1

DescriptionCVE.org

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 4

medium.com CVE-2026-42945: Critical Heap Buffer Overflow in NGINX HTTP Rewrite Module (NGINX Rift) May 28, 2026 POC NGINX Rift: Heap Buffer Overflow in ngx_http_rewrite_module Affects Versions 0.6.27-1.30.1 (CVE-2026-42945, CVE-2026-9256) May 27, 2026 medium.com CVE-2026-42945: Critical NGINX Vulnerability Discovered After 18 Years May 14, 2026 POC POC: exploit for CVE-2026-42945 May 13, 2026

Executive ViewAI

Why It Matters

A critical heap buffer overflow in NGINX Plus and NGINX Open Source rewrite modules (CVE-2026-42945, CVSS 9.2) could allow remote attackers to crash worker processes or execute arbitrary code on systems lacking ASLR protections. Organizations running NGINX with specific rewrite directive configurations are at risk of service disruption and potential compromise, requiring immediate patch deployment to maintain application availability and security posture.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, implement network-level access controls to restrict HTTP traffic to NGINX instances to trusted sources only, and disable or reconfigure PCRE-based rewrite directives with question marks in replacement strings until patches are deployed.

Threat Intelligence Overview

Threat Score
5.3/10
Composite threat intelligence
EPSS Score
0.2%
Top 63% exploitable
Threat Intel
4
1 sources
Exploit
POC
Public exploit code exists
Social Media
138
Sightings
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA NEWS MSRC Vendor CIRCL 138 sightings GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Total

Priority Score

76
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Nginx Plus

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-42055 CRITICAL POC
9.2 Jun 17

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
CVE-2026-9256 CRITICAL POC
9.2 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem
CVE-2026-42533 CRITICAL POC
9.2 Jul 15

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
CVE-2026-97205 CRITICAL
9.2 Oct 14

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O
CVE-2026-93479 CRITICAL
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
CVE-2026-15176 CRITICAL
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
CVE-2026-60005 HIGH
8.8 Jul 15

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt
CVE-2026-27654 HIGH POC
8.8 Mar 24

Buffer overflow in NGINX's DAV module allows remote attackers to crash worker processes or manipulate file names outside
CVE-2026-27651 HIGH
8.7 Mar 24

NGINX worker process crashes via null pointer dereference in the mail authentication module when CRAM-MD5 or APOP authen
CVE-2024-39792 HIGH
8.7 Aug 14

When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory

CVE-2026-32647 HIGH
8.5 Mar 24

NGINX Open Source and NGINX Plus contain a buffer over-read or over-write vulnerability in the ngx_http_mp4_module that

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-03
Security News Coverage
medium.com csa.gov.sg thecyberexpress.com
Sources: Security News RSS, Microsoft MSRC, CISA (public domain)

References

Advisories & patches
PATCH https://my.f5.com/manage/s/article/K000161019 ADVISORY https://access.redhat.com/errata/RHSA-2026:17417 ADVISORY https://access.redhat.com/errata/RHSA-2026:17751 ADVISORY https://access.redhat.com/errata/RHSA-2026:17752 ADVISORY https://access.redhat.com/errata/RHSA-2026:17753 ADVISORY https://access.redhat.com/errata/RHSA-2026:17790 ADVISORY https://access.redhat.com/errata/RHSA-2026:17791 ADVISORY https://access.redhat.com/errata/RHSA-2026:17792 ADVISORY https://access.redhat.com/errata/RHSA-2026:17793 ADVISORY https://access.redhat.com/errata/RHSA-2026:17794 ADVISORY https://access.redhat.com/errata/RHSA-2026:18029 ADVISORY https://access.redhat.com/errata/RHSA-2026:18041 ADVISORY https://access.redhat.com/errata/RHSA-2026:18063 ADVISORY https://access.redhat.com/errata/RHSA-2026:19159 ADVISORY https://access.redhat.com/errata/RHSA-2026:19371 ADVISORY https://access.redhat.com/errata/RHSA-2026:19372 ADVISORY https://access.redhat.com/errata/RHSA-2026:19374 ADVISORY https://access.redhat.com/errata/RHSA-2026:20442 ADVISORY https://access.redhat.com/errata/RHSA-2026:20444 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42945 ADVISORY https://ubuntu.com/security/notices/USN-8375-1 ADVISORY https://vuldb.com/vuln/363570 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-42945 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:22382 REF https://access.redhat.com/errata/RHSA-2026:22383 REF https://access.redhat.com/errata/RHSA-2026:22388 REF https://access.redhat.com/errata/RHSA-2026:22389 REF https://access.redhat.com/errata/RHSA-2026:22390 REF https://access.redhat.com/errata/RHSA-2026:22393 REF https://access.redhat.com/errata/RHSA-2026:22394 REF https://access.redhat.com/errata/RHSA-2026:22396 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/security/cve/CVE-2026-42945 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477116 REF https://depthfirst.com/nginx-rift REF https://github.com/DepthFirstDisclosures/Nginx-Rift REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy