Back Securityaffairs.Co

NGINX Rift: an 18-year-old flaw in the world’s most deployed web server just came to light

Securityaffairs.Co •Pierluigi Paganini • May 14, 2026

Researchers found a critical 18-year-old buffer overflow flaw in NGINX, tracked as CVE-2026-42945 and named NGINX Rift. If you run NGINX, and statistically speaking, there is a very good chance you do, this week brought news worth stopping for. Security researchers at depthfirst disclosed a critical heap buffer overflow vulnerability in both NGINX Plus and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical NGINX Vulnerability CVE-2026-42945 Exposes Millions to RCE and DoS Attacks A critical vulnerability, CVE-2026-42945, has been discovered in the NGINX web server's ngx_http_rewrite_module, allowing unauthenticated attackers to execute remote code or crash servers. This heap-based buffer overflow has existed for 18 years, affecting all versions from 0.6.27 to 1.30.0. Attackers can exploit this flaw by sending specially crafted HTTP requests, particularly in configurations using unnamed PCRE captures followed by certain directives. The vulnerability has been rated with a CVSS score of 9.2, indicating its critical nature. Emergency patches have been released, but the exploit is already public, raising concerns about imminent attacks. Organizations running NGINX are urged to update their systems immediately to mitigate risks. The vulnerability is particularly dangerous for internet-facing servers with non-trivial rewrite rules. 51 sources 79

Extracted Entities

NGINX Rift: an 18-year-old flaw in the world’s most deployed web server just came to light

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

Platforms (1)

Tools (1)

Vulnerabilities (1)