CVE-2026-42945
Published: 13 May 2026
Summary
CVE-2026-42945 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in F5 Nginx Ingress Controller. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
NGINX Plus and NGINX Open Source contain a vulnerability in the ngx_http_rewrite_module module that triggers when a rewrite directive is followed by another rewrite, if, or set directive using an unnamed PCRE capture such as $1 or $2 in a replacement string containing a question mark. The flaw is tracked as CVE-2026-42945, carries a CVSS 4.0 score of 9.2, and is classified under CWE-122 for heap-based buffer overflow.
An unauthenticated attacker can trigger the issue by sending specially crafted HTTP requests, provided configuration conditions beyond the attacker's direct control are also met. Successful exploitation produces a heap buffer overflow in the NGINX worker process that can cause a restart; under additional constraints such as disabled ASLR or successful ASLR bypass, the same flaw permits remote code execution.
Public advisories and technical disclosures at https://my.f5.com/manage/s/article/K000161019, https://depthfirst.com/nginx-rift, and https://github.com/DepthFirstDisclosures/Nginx-Rift address mitigation steps for supported versions.
The associated EPSS probability rose from a starting value of 0.0029 to a peak of 0.0104, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30010
Vulnerability details
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1,…
more
$2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via crafted HTTP requests against public-facing NGINX web server (heap buffer overflow in rewrite module).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches that eliminate the ngx_http_rewrite_module heap overflow described in the CVE.
Mandates secure configuration settings that prohibit the exact rewrite/if/set directive pattern with unnamed PCRE captures and “?” replacement strings that trigger the flaw.
Boundary-protection devices (WAF/IPS) can inspect HTTP requests and block the crafted rewrite-URI patterns used to reach the vulnerable code path.