NGINX ngx_http_rewrite_module vulnerability
Not confirmed exploited. 2 of 8 rule sources name it; Cloudflare blocks by default. 1 public exploit repo.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular… More
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 4.0Exploitable over the network under specific conditions, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability.
How the score is built
- Attack vectorAn attacker can reach it over the internet; no access to your network needed.Network
- Attack complexityThe attacker must first defeat a security measure, such as address randomisation, or obtain a secret.High
- Attack requirementsThe attack works without any special deployment or timing conditions.None
- Privileges requiredNo account or login is needed.None
- User interactionNo one has to click or open anything; the attack works on its own.None
- Confidentiality impact (vulnerable system)An attacker can read all data the affected component holds, or the most sensitive parts of it.High
- Integrity impact (vulnerable system)An attacker can change any data or files the affected component protects.High
- Availability impact (vulnerable system)An attacker can take the component down completely or keep it from serving anyone.High
- Confidentiality impact (other systems)Other systems' data is not exposed.None
- Integrity impact (other systems)Other systems' data cannot be changed.None
- Availability impact (other systems)Other systems keep working normally.None
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCISA has seen no public exploit and no attacks.
At least one step needs hands-on work, which slows mass attacks.
A successful attack gives full control over the affected software or all of its data.
Public exploits
1 foundNo exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.
Links are to third-party code: never run it outside an isolated lab.
Timeline
- 2026-05-13CVE publishedCVE List
- 2026-05-15Cloudflare ships a rulenginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945
- 2026-07-07F5 ships a ruleNginx Rift Buffer Overflow
- 2026-11-02First public exploit repositorybasesixtythree/B63-POC-CVE-2026-42945: PoC and verification material for CVE-2026-42945 (CWE-122 heap overflow in ngx_http_rewrite_module -> attacker-shaped cleanup hijack -> system() RCE in the ASLR-off worker; patched-twin negative + 5/5 reliability captured in the shipped lab)
- 2026-11-02
Vendor statements
QuotedCloudflareWAF Managed Rules
First rule 2026-05-15, 2 days after the CVE was published.
nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945. Previous action: N/A. New action: Block. This is a new detection.
nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945. Previous action: N/A. New action: Block. This is a new detection.
AWSAWS WAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.
Google CloudCloud Armor preconfigured WAF rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.
FastlyNext-Gen WAF virtual patches
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
F5Attack signatures (Distributed Cloud WAF)
First rule 2026-07-07, 55 days after the CVE was published.
Added: signature 200011109 "Nginx Rift Buffer Overflow" (Buffer Overflow, risk Low), systems: Nginx. References: CVE-2026-42945.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.
Social
Exploit repos · unvetted, don't run
basesixtythree/B63-POC-CVE-2026-42945: PoC and verification material for CVE-2026-42945 (CWE-122 heap overflow in ngx_http_rewrite_module -> attacker-shaped cleanup hijack -> system() RCE in the ASLR-off worker; patched-twin negative + 5/5 reliability captured in the shipped lab)