Riskcovery

CVE-2026-42945

NGINX ngx_http_rewrite_module vulnerability

State
Published
Severity
9.2 Critical
Published
May 13, 2026
Updated
Sep 10, 2026
Reserved
Apr 30, 2026

Read the record on cve.org

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSSScoreVectorSource
4.09.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nf5
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hf5
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-122 Heap-based Buffer Overflow.
  • CWE-131 Incorrect Calculation of Buffer Size

Affected Products

ProductVersions
NGINX PlusF5
  • R37 and laterNot affected
  • R36 to before R36 P4Affected
  • R32 to before R32 P6Affected
NGINX Open SourceF5
  • 1.31.0 and laterNot affected
  • 0.6.27 to before 1.30.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.