Credential Stuffing

CVE-2026-42945 marks the disclosure of one of the most serious security vulnerabilities in the NGINX ecosystem in recent years. The security vulnerability is known as ‘NGINX Rift’ and affects both NGINX Open Source and NGINX Plus. Particularly alarming: the bug appears to have existed in the code for around 18 years and, under certain configurations, enables remote code execution (RCE) without authentication, simply through manipulated HTTP requests.

Summary

A fault in ngx_http_rewrite_module leads to a heap-based buffer overflow within an NGINX worker process. An attacker can send specially crafted URIs to overwrite memory areas outside the intended buffer.

The vulnerability occurs when the following conditions are met:

• A rewrite-directive uses unnamed regex captures such as $1 or $2
• The replacement string contains a question mark (?)
• This is followed by another rewrite, if or setdirective within the same scope

Under these circumstances, NGINX incorrectly calculates the target size of the buffer and subsequently writes more data into it than intended. The result is a deterministic heap overflow that can be exploited for remote code execution.

Why this vulnerability is so critical

NGINX currently underpins a significant portion of the public internet, ranging from small blogs to global Cloud platforms. This makes CVE-2026-42945 particularly dangerous:

• No authentication required
• Directly accessible from the internet
• A single HTTP request is sufficient
• Controllable memory corruption
• Potential complete takeover of the worker process

As the overwritten bytes originate directly from the manipulated URI, an attacker can specifically manipulate the heap corruption. In addition to RCE, persistent crash loops are also possible, which can effectively cripple websites.

Which systems are affected

The vulnerability lies in the module ngx_http_rewrite_module, which is part of virtually every standard NGINX installation.

NGINX Open Source

• Versions 0.6.27 to 1.30.0

NGINX Plus

• Releases R32 to R36

Other affected products:

• NGINX Instance Manager 2.16.0 – 2.21.1
• F5 WAF for NGINX 5.9.0 – 5.12.1
• NGINX App Protect WAF 4.9.0 – 4.16.0 and 5.1.0 – 5.8.0
• NGINX Gateway Fabric 1.3.0 – 1.6.2 and 2.0.0 – 2.5.1
• NGINX Ingress Controller 3.5.0 – 5.4.1

According to the advisory, the following are not affected, amongst others:

• F5 Distributed Cloud
• F5 Silverline
• BIG-IP
• BIG-IQ
• F5OS
• NGINX One Console

How the attack works

The root cause lies deep within src/http/ngx_http_script.c. Put simply:

This results in a classic heap overflow. A particular problem here is that the attacker can partially control the data being written, which creates ideal conditions for exploitation.

Vulnerable configuration and secure alternative

Insecure rewrite rule

rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

This configuration uses unnamed captures ($1, $2) and is therefore potentially vulnerable.

Secured rewrite rule with named captures

rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

The recommended mitigation is to use named captures. This bypasses the faulty processing path.

Which updates are available

The following versions fix the vulnerability:

• NGINX Open Source: fixed in 1.30.1 and 1.31.0
• NGINX Plus R32: fixed in R32 P6
• NGINX Plus R36: fixed in R36 P4

After the upgrade, NGINX must be completely restarted to ensure that all workers load the patched binary code.

What should you do if an upgrade is not currently possible?

If a patch cannot be applied in the short term:

• Check all rewriterules
• Unnamed captures ($1, $2)
• Switch to named captures
• Pay particular attention to rules with ? in the replacement string

Also worth doing:

• Enable WAF rules
• Log unusual URI patterns
• Monitor worker crashes
• Implement ASLR and use the latest libc versions

These measures do not completely prevent the vulnerability, but they do make it more difficult to exploit reliably.

Why ‘NGINX Rift’ is a wake-up call

This vulnerability demonstrates once again just how dangerous decades-old parsing and memory management errors can be in critical infrastructure.

NGINX has been regarded as extremely stable and high-performing for years. This is precisely why many organisations are likely to be surprised that such an old bug remained undetected and, at the same time, can have such serious consequences.

The attack surface could be enormous, particularly in Kubernetes environments with ingress controllers or API gateways.

Conclusion: What affected organisations should do now

CVE-2026-42945 is not a theoretical edge-case vulnerability, but a realistically exploitable heap overflow in one of the internet’s most important web server components.

Anyone operating NGINX should now:

• Identify affected versions
• Audit rewrite configurations
• Apply patches as soon as possible
• Monitor logs and worker processes

As the attack works without authentication and requires only a single HTTP request, the barrier to entry for attackers is extremely low. For many organisations, this is likely to be one of the most important infrastructure updates of 2026.

How Mint Secure supports you

Whether it’s identifying affected systems, hardening your environment during the patching phase, or responding in an emergency: we support you at every stage.

Sources: General write-up · Technical details