NGINX Rift: Achieving NGINX RCE via an 18-Year-Old Vulnerability (CVE-2026-42945)

What it is

Four confirmed NGINX memory-corruption CVEs found by depthfirst's autonomous code-analysis system (6-hour scan, 5 issues reported, 4 confirmed). The summary covers CVE-2026-42945's mechanism and exploit chain; what it omits is severity ratings, the other three bugs' mechanisms, the exploit's real limits, and the version boundaries an engineer needs to triage.

• CVE-2026-42945 (Critical, CVSS 9.2) — heap overflow in ngx_http_rewrite_module.
• CVE-2026-42946 (High, CVSS 8.3) — ngx_http_scgi_module/ngx_http_uwsgi_module: a state mismatch after an incomplete upstream status-line read causes a cross-buffer pointer subtraction, producing a ~1 TB key length that crashes the worker (DoS).
• CVE-2026-40701 (Medium, CVSS 6.3) — ngx_http_ssl_module use-after-free: if a TLS connection closes before async OCSP DNS resolution finishes, the context pool is destroyed without cancelling the resolver, and the DNS timer later dereferences the freed pointer.
• CVE-2026-42934 (Medium, CVSS 6.3) — ngx_http_charset_module off-by-one on incomplete UTF-8 across proxy buffer boundaries, yielding a negative source offset and a 2-byte OOB read.

Preconditions / Affected

CVE-2026-42945 requires a config using both rewrite (with a ? in the replacement, setting is_args) and set referencing a capture group — common in API-gateway configs. Minimal trigger:

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;
    set $original_endpoint $1;
}

Affected version ranges (the summary lists product families, not bounds):

• NGINX Open Source 0.6.27 – 1.30.0 (bug introduced 2008)
• NGINX Plus R32 – R36
• NGINX Instance Manager 2.16.0 – 2.21.1
• F5 WAF for NGINX 5.9.0 – 5.12.1; App Protect WAF 4.9.0 – 4.16.0 and 5.1.0 – 5.8.0
• F5 DoS for NGINX 4.8.0; App Protect DoS 4.3.0 – 4.7.0
• NGINX Gateway Fabric 1.3.0 – 1.6.2 and 2.0.0 – 2.5.1
• NGINX Ingress Controller 3.5.0 – 3.7.2, 4.0.0 – 4.0.1, 5.0.0 – 5.4.1

What to do

F5 released the advisory on 5/13/2026; upgrade past the ranges above. If you cannot patch immediately, audit configs for the rewrite-with-query-string plus capture-group-set pattern — absent that pattern, 42945 is not reachable. A PoC is published on depthfirst's GitHub.

Caveats

The working RCE PoC assumes ASLR is already off — the writeup only theorizes an ASLR bypass (byte-by-byte pointer overwrite exploiting NGINX's deterministic fork-inherited heap, which also makes crashes retry-safe since the master respawns workers with identical layout). The overflow is constrained to URI-safe bytes (padding with +/%2B); arbitrary pointers with null bytes are injected separately via POST bodies sprayed as fake ngx_pool_cleanup_s structures, then reached by partially overwriting the pool's cleanup pointer at offset 64. So this is a real unauthenticated-RCE path, but the demonstrated exploit is not turnkey against an ASLR-enabled target.