Full Report
Researchers say 18-year-old flaw already being probed and exploited just days after disclosure
Analysis Summary
# Vulnerability: NGINX Rift (Heap-based Buffer Overflow)
## CVE Details
- **CVE ID:** CVE-2026-42945
- **CVSS Score:** 9.2 (Critical)
- **CWE:** CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products:** NGINX Open Source, NGINX Plus
- **Versions:** Affected versions dating back to 2008 (v0.6.18 through current versions prior to the May 2026 patch).
- **Configurations:** Systems utilizing the `ngx_http_rewrite_module` with specific rewrite configurations.
## Vulnerability Description
Dubbed "NGINX Rift," this is a heap-based buffer overflow vulnerability residing in the NGINX rewrite module. The flaw has existed in the codebase for 18 years. An unauthenticated attacker can trigger the overflow by sending specially crafted HTTP requests to a vulnerable server. Technical analysis indicates the flaw is specifically located within how the module handles certain URI rewrites, leading to memory corruption.
## Exploitation
- **Status:** Exploited in the wild; Public PoC available.
- **Complexity:** High (Reliable Remote Code Execution (RCE) requires specific server configurations and the absence of modern memory protections).
- **Attack Vector:** Network (Remote/Unauthenticated).
## Impact
- **Confidentiality:** High (If RCE is achieved).
- **Integrity:** High (If RCE is achieved).
- **Availability:** High (Worker processes can be crashed repeatedly, leading to Denial of Service).
## Remediation
### Patches
- F5/NGINX released patches in May 2026. Users should update to the latest stable versions of NGINX Open Source and NGINX Plus immediately.
### Workarounds
- Ensure **ASLR (Address Space Layout Randomization)** is enabled at the OS level to mitigate the risk of RCE.
- Review and temporarily disable complex `rewrite` rules if patching cannot be performed immediately, though this may impact site functionality.
## Detection
- **Indicators of Compromise:** Unusual NGINX worker process crashes or restarts recorded in error logs.
- **Detection methods and tools:**
- Use `Censys` or similar scanning tools to identify exposed NGINX versions.
- Monitor for specific crafted HTTP requests matching signatures identified by security vendors like VulnCheck.
## References
- **F5 Security Advisory:** hxxps[://]my[.]f5[.]com/manage/s/article/CVE-2026-42945 (Hypothetical)
- **VulnCheck Research:** hxxps[://]docs[.]vulncheck[.]com/initial-access/2026-05-15#cve-2026-42945
- **Depthfirst Technical Analysis:** hxxps[://]depthfirst[.]com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability