CVE-2026-42945: Heap Buffer Overflow in Nginx

Vulnerabilities
, ,
1

Last Updated: 2026-05-14T12:44:37Z

CVSSv3: 9.2 (Critical)

F5 just released this vulnerability in Nginx (open source and Plus).

A heap buffer overflow exists in the nginx rewrite module when a rewrite, if, or set directive is followed by an unnamed Perl-Compatible Regular Expression capture using a replacement string that contains a question mark. An unauthenticated attacker can send specially crafted HTTP requests to the affected server. The overflow may trigger a worker process restart, and if the system has Address Space Layout Randomization disabled, the vulnerability can be leveraged to achieve code execution at the worker process level.

So first of all, don’t have ASLR disabled I guess. But also, an insta-restart of Nginx is a DoS if sustained.

Successful exploitation of this vulnerability requires rewrite and set directives in one’s Nginx config. These are not default, but also not uncommon. The researcher writeup (linked below) explains one plausible scenario:

Imagine you are migrating a legacy API to a new system. You need to seamlessly route incoming requests to the new endpoints. The rewrite directive allows you to modify the request path on the fly. However, your backend application might still need to know the original requested path. This is exactly where the set directive proves essential. It lets you capture and store the original path in a custom variable before the rewrite occurs. Together, these two directives are common building blocks in API gateway configurations.

An attacker would have to know that these directives were in place in order to exploit them directly, or simply fire off the attack blindly at every Nginx endpoint they see.

The attack is not a one-shot, and spraying vulnerable endpoints would be quite noisy and detectable in logging or Web Application Firewall events.

Patches/Mitigations

Fixes have been made available for Nginx open source in versions 1.31.0 and 1.30.1. Watch for new repository packages.

The sub-1.0 series will not be patched.

PoCs

Writeup from the original researcher here:

3 Likes
2
2 Likes
3

Nice scanner if you run nginx but aren’t an expert on the configuration syntax.

1 Like
4

Updated packages available for Debian Trixie;

nginx (1.26.3-3+deb13u5) trixie-security; urgency=medium

  * backport changes from upstream nginx, HTTP/3 address spoofing
    (CVE-2026-40460), buffer overflow in the ngx_http_rewrite_module
    (CVE-2026-42945), buffer overread in the ngx_http_scgi_module and
    ngx_http_uwsgi_module (CVE-2026-42946), resolver use-after-free in OCSP
    (CVE-2026-40701), buffer overread in the ngx_http_charset_module
    (CVE-2026-42934)
    * d/p/CVE-2026-40460.patch add
    * d/p/CVE-2026-42945.patch add
    * d/p/CVE-2026-42946.patch add
    * d/p/CVE-2026-40701.patch add
    * d/p/CVE-2026-42934.patch add

 -- Jan Mojžíš <janmojzis@debian.org>  Fri, 15 May 2026 14:13:33 +0000