CVE-2026-42945

nvd.nist.gov • May 13, 2026

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical NGINX Vulnerability CVE-2026-42945 Exposes Millions to RCE and DoS Attacks A critical vulnerability, CVE-2026-42945, has been discovered in the NGINX web server's ngx_http_rewrite_module, allowing unauthenticated attackers to execute remote code or crash servers. This heap-based buffer overflow has existed for 18 years, affecting all versions from 0.6.27 to 1.30.0. Attackers can exploit this flaw by sending specially crafted HTTP requests, particularly in configurations using unnamed PCRE captures followed by certain directives. The vulnerability has been rated with a CVSS score of 9.2, indicating its critical nature. Emergency patches have been released, but the exploit is already public, raising concerns about imminent attacks. Organizations running NGINX are urged to update their systems immediately to mitigate risks. The vulnerability is particularly dangerous for internet-facing servers with non-trivial rewrite rules. 51 sources 79

Extracted Entities

CVE-2026-42945

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Tools (1)