Cybersecurity researchers said NGINX Plus and NGINX Open Source are affected by multiple security flaws, including a critical heap buffer overflow in the rewrite module that was hidden for 18 years and can let a remote attacker trigger code execution or a denial of service with crafted requests.
KEY FACTS
- Critical flaw The issue is tracked as CVE-2026-42945 and has a CVSS v4 score of 9.2.
- Impact Crafted HTTP requests can overflow heap memory in the NGINX worker process.
- Scope The affected software includes NGINX Plus, NGINX Open Source and several related F5 and NGINX products.
- Fixes Patches were released after disclosure on April 21, 2026.
According to a technical analysis from depthfirst, the flaw affects the ngx_http_rewrite_module when a rewrite directive is followed by a rewrite, if, or set directive and an unnamed capture with a replacement string that includes a question mark. The report said a single request can be enough to overflow the heap in the worker process.
F5 said the vulnerability can be exploited by an unauthenticated attacker sending crafted HTTP requests. It added that code execution may be possible on systems where Address Space Layout Randomization is disabled, while other systems may see worker restarts and denial of service.
The advisory lists fixes in NGINX Plus R32 P6 and R36 P4, and in NGINX Open Source 1.30.1 and 1.31.0. Versions of NGINX Open Source from 0.6.27 through 0.9.7 have no planned fixes, according to the notice.
F5 also patched three other flaws, including CVE-2026-42946 in the scgi and uwsgi modules, CVE-2026-40701 in the ssl module and CVE-2026-42934 in the charset module. The disclosure said users should update to the latest versions, or for CVE-2026-42945 replace unnamed captures with named captures if patching is not immediately possible.
WHY IT MATTERS
The flaw affects software widely used to serve web traffic, which can make a single exposed server a target for remote attacks and outages. The disclosure suggests administrators should patch quickly or change rewrite rules to reduce the risk of worker crashes or possible code execution.