Attackers Are Exploiting Critical NGINX Vulnerability CVE-2026-42945

A critical memory corruption vulnerability in NGINX, tracked as CVE-2026-42945 and dubbed NGINX Rift, has moved from public disclosure to active exploitation. Security researchers say attackers began probing and attacking vulnerable servers within days of technical details and a proof-of-concept exploit becoming available. The flaw can be triggered with a specially crafted HTTP request, making it a serious risk for a web server that powers a large share of modern internet infrastructure.

NGINX is not just a web server. It is also widely used as a load balancer, reverse proxy, and HTTP cache. That makes any exploitable bug in its request-processing path a potential problem for websites, APIs, cloud services, and internal applications. CVE-2026-42945 is especially concerning because it can lead to denial-of-service and may, under certain conditions, allow unauthenticated remote code execution.

Key Facts at a Glance

• Vulnerability: CVE-2026-42945, also known as NGINX Rift.
• Type: Heap-based memory corruption in the ngx_http_rewrite_module.
• Impact: Denial-of-service and potential unauthenticated remote code execution.
• Affected versions: NGINX Open Source 0.6.27 through 1.30.0; NGINX Plus R32 through R36; and some F5 products that embed NGINX.
• Exploitation status: Active exploitation observed after public proof-of-concept release.
• Attacker requirements: A crafted URI and a specific but common rewrite configuration.
• Fixes: NGINX Open Source 1.31.0 and 1.30.1; NGINX Plus R36 P4 and R32 P6; F5 WAF for NGINX 5.13.0; F5 DoS for NGINX 4.9.0.
• Mitigation: Use named captures instead of unnamed captures in rewrite directives.

What Is NGINX and Why It Matters

NGINX is one of the most widely deployed web servers in the world. It is used by small websites, large enterprises, content delivery networks, cloud platforms, and government services. Its event-driven architecture makes it efficient at handling many simultaneous connections, which is why it became a default choice for high-traffic applications and microservices. It can also terminate TLS, route traffic, cache content, and balance load across backend servers.

Development of NGINX is overseen by F5, which maintains the open-source version, offers the commercial NGINX Plus edition, and integrates NGINX into several application delivery and security products. Because NGINX often sits at the edge of a network, a vulnerability that can be triggered before authentication is especially dangerous. An attacker does not need valid credentials, a session, or a user interaction. A single crafted request may be enough to disrupt service or, in a worst-case scenario, compromise a worker process.

Understanding CVE-2026-42945: NGINX Rift

CVE-2026-42945 is a memory corruption vulnerability that affects NGINX Open Source versions 0.6.27 through 1.30.0 and NGINX Plus versions R32 through R36. It also affects some F5 products that incorporate NGINX, including NGINX Ingress Controller and F5 WAF for NGINX. The flaw resides in the ngx_http_rewrite_module, a component that handles URL rewriting rules. These rules are common in production configurations, where administrators use them to redirect traffic, normalize URLs, enforce canonical paths, or perform conditional routing.

The bug is triggered by a specific combination of rewrite directives. According to technical analyses, the vulnerable pattern involves a rewrite directive with an unnamed regex capture, such as $1 or $2, and a replacement string that contains a question mark. That rewrite must be followed by another rewrite, if, or set directive. When this pattern exists, NGINX calculates the destination buffer size using one set of escaping assumptions and then writes data using another. The result is a write that runs past the allocated buffer, producing deterministic memory corruption.

What makes the corruption particularly dangerous is that the bytes written beyond the allocated buffer are derived from the attacker-controlled URI. The overflow is therefore not random. An attacker can shape the corrupted memory to a significant degree. Repeated requests can be used to keep NGINX worker processes in a crash loop, degrading availability for every site served by that instance. In more advanced scenarios, the same primitive may be leveraged for code execution if other protections can be bypassed or disabled.

The Technical Mechanics of the NGINX Rift Exploit

The exploit relies on a mismatch between buffer size calculation and buffer writing. In the vulnerable rewrite module, NGINX must decide how large a destination buffer needs to be after applying a rewrite rule. That calculation depends on escaping rules, such as how certain characters are encoded or interpreted. When a replacement string includes a question mark, and unnamed captures are used, the assumptions used for sizing can diverge from the assumptions used when writing the final value.

The write then exceeds the heap allocation. Because the overflowing bytes come from the request URI, the attacker can influence the layout and content of the corrupted heap. This is more than a simple crash bug. Deterministic heap corruption can sometimes be turned into control-flow hijacking, especially when combined with information leaks or when memory protections are absent. However, exploitation is not guaranteed on every target. The vulnerable rewrite configuration must be present, and additional conditions may affect whether code execution is achievable.

The vulnerability was disclosed along with four other security issues. Of those five, CVE-2026-42945 was judged the most critical. Once fixes and an advisory were released, technical details and a proof-of-concept exploit were published. That sequence is common in vulnerability research: defenders get a patch, but attackers also get a roadmap. In this case, exploitation attempts began within about three days of the public proof-of-concept release, according to observations from security monitoring systems.

Proof-of-Concept and Active Exploitation

The public proof-of-concept demonstrated that the flaw could be triggered reliably against vulnerable configurations. Attackers quickly incorporated the technique into scanning and exploitation activity. Monitoring systems detected exploitation attempts beginning on May 16, three days after the vulnerability and proof-of-concept became public. The effectiveness of those attempts depends heavily on the target. Many systems may only experience denial-of-service, while others may be susceptible to deeper compromise.

Denial-of-service is the most immediate risk. An attacker can send requests that crash NGINX worker processes repeatedly. If the master process restarts workers, the attacker can continue the cycle, causing resource exhaustion and service instability. For high-traffic sites, even brief outages can translate into lost revenue, disrupted operations, and reputational damage. For critical infrastructure, availability problems can have broader consequences.

Remote code execution is the more severe but less certain outcome. Researchers noted that code execution may be possible if an attacker can disable address space layout randomization (ASLR) on the target server. ASLR randomizes memory addresses to make exploitation harder. If it is disabled or bypassed, the deterministic nature of the heap corruption becomes more useful to an attacker. Some environments may have ASLR weakened by configuration, kernel settings, or other vulnerabilities. That makes patch urgency even higher.

Exposure and Who Is at Risk

Not every NGINX instance is exploitable. The target server must be running a specific rewrite configuration that matches the vulnerable pattern. That caveat reduces the exploitable population, but it does not eliminate the risk. Internet-wide scanning has identified millions of internet-exposed NGINX servers running potentially vulnerable versions. The true number of exploitable systems is likely a smaller subset, but even a small percentage of millions is significant.

Organizations should assume that any internet-facing NGINX instance with custom rewrite rules may be at risk until proven otherwise. Internal NGINX deployments should not be ignored either. An attacker who gains a foothold in a corporate network could use the same flaw against internal reverse proxies, API gateways, or service meshes. The vulnerability is unauthenticated, so it can be triggered from any network position that can reach the NGINX service.

Cloud environments are particularly challenging. NGINX is often embedded in Kubernetes ingress controllers, load balancers, and managed application delivery services. In those cases, the organization may not directly manage the underlying NGINX binary, but it still depends on the service. Administrators should check with their cloud providers and platform vendors to confirm whether patches have been applied. They should also review their own rewrite configurations for the vulnerable pattern.

F5 Fixes and Vendor Patches

F5 has released fixes for the vulnerability in several product lines. The patched versions include:

• NGINX Open Source version 1.31.0 and 1.30.1
• NGINX Plus version R36 P4 and R32 P6
• F5 WAF for NGINX version 5.13.0
• F5 DoS for NGINX version 4.9.0

F5 also provided a mitigation for organizations that cannot immediately upgrade. The mitigation is to use named captures instead of unnamed captures in rewrite definitions. Named captures make the rewrite rule more explicit and avoid the parsing ambiguity that leads to the buffer mismatch. This mitigation is not a substitute for patching, but it can reduce exposure while updates are tested and deployed.

Several Linux distributions have begun releasing patched NGINX packages. Administrators should check their package repositories for updated nginx builds and apply them as soon as possible. In containerized environments, base images and ingress controller images must also be updated. It is not enough to patch the host if the vulnerable NGINX runs inside a container that was built from an older image.

Mitigation Guidance for Administrators

The first priority is to identify all NGINX instances and determine their versions. This includes internet-facing web servers, reverse proxies, load balancers, API gateways, Kubernetes ingress controllers, and embedded appliances. Inventory should cover both open-source and commercial deployments, because the flaw affects NGINX Open Source and NGINX Plus.

Next, administrators should inspect rewrite configurations. The vulnerable pattern involves a rewrite directive with unnamed regex captures, a replacement string containing a question mark, and a following rewrite, if, or set directive. Configurations that use named captures are not affected by the documented mitigation path. Where possible, rewrite rules should be refactored to use named captures. After any configuration change, the NGINX configuration should be tested and reloaded carefully to avoid introducing new errors.

Patching remains the definitive fix. Organizations should upgrade to NGINX Open Source 1.31.0 or 1.30.1, or NGINX Plus R36 P4 or R32 P6. For F5 WAF for NGINX, the fixed version is 5.13.0. For F5 DoS for NGINX, the fixed version is 4.9.0. If immediate patching is not possible, the named-capture mitigation should be applied, and additional monitoring should be enabled for crashes, abnormal worker restarts, and suspicious request patterns.

Detection and Response Considerations

Detection can be difficult because the exploit uses HTTP requests that may look like normal traffic. Security teams should review logs for repeated requests with unusual URIs, especially those that contain question marks in rewritten paths or patterns that target rewrite-heavy endpoints. A sudden increase in 500-level errors, worker process crashes, or service restarts may indicate exploitation attempts. Rate limiting and web application firewall rules can help reduce the volume of malicious requests, but they should not be treated as a complete fix.

Incident responders should also consider whether an attacker could have achieved code execution. If ASLR was disabled or if the system shows signs of post-exploitation activity, a deeper compromise investigation may be necessary. Indicators of compromise may include unexpected processes, outbound connections, modified files, or new user accounts. Because the vulnerability is in a worker process, a crash alone does not prove code execution, but repeated crashes combined with other anomalies warrant investigation.

The Broader Context: Why NGINX Flaws Are High-Impact

NGINX is a foundational component of modern web infrastructure. It often terminates encryption, enforces routing rules, and protects backend services from direct exposure. When a vulnerability exists in a component that processes untrusted HTTP requests, the blast radius can be large. Attackers do not need to compromise an application first. They can attack the web server directly. That is why memory corruption flaws in NGINX are treated as high-severity events.

The rapid exploitation of CVE-2026-42945 also illustrates the shrinking window between disclosure and attack. Once a proof-of-concept is public, automated scanners and exploit kits can adapt quickly. Organizations that rely on slow patch cycles may find themselves exposed within days. In this case, the exploit is not purely theoretical. It has been observed in the wild, and the vulnerable pattern is common enough that many production environments need to verify their configurations.

The flaw also highlights the importance of configuration hygiene. Rewrite rules are powerful but complex. Unnamed captures and special characters can interact in unexpected ways. Using named captures, testing rewrite behavior, and minimizing complexity can reduce both security risk and operational surprises. While the immediate priority is patching, longer-term improvements in configuration review and inventory management will help organizations respond faster to future vulnerabilities.

Patched packages are now becoming available across major Linux distributions and container ecosystems. Administrators should treat CVE-2026-42945 as an emergency patch item, verify that all NGINX instances are updated, and confirm that mitigation rules are in place where upgrades cannot be completed immediately. The vulnerability is actively exploited, the technical details are public, and the affected software is ubiquitous. Those three factors together make swift action essential.

Source: Help Net Security News