CVE-2026-42945: NGINX heap buffer overflow in ngx_http_rewrite_module

CVE-2026-42945 · Severity: high · CVSS 8.1 · Published 2026-05-13

NGINX, a widely used web server and reverse proxy, contains a critical vulnerability in its URL rewriting module. An unauthenticated attacker can send specially crafted web requests to trigger a memory error, potentially allowing them to crash the service or take full control of the server. This issue affects systems using specific configuration patterns involving URL rewrites and regular expressions.

Technologies: F5 NGINX Instance Manager, F5 Nginx Ingress Controller, F5 Nginx Plus, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-42945 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42945 being exploited in the wild.
How severe is CVE-2026-42945?
High severity, with a CVSS score of 8.1, published 13 May 2026.
Which products and versions are affected?
F5 NGINX App Protect WAF 4.9.0 through 4.16.0; 5.1.0 through 5.8.0; F5 NGINX Instance Manager 2.16.0 through 2.21.1; F5 Nginx Ingress Controller 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.1; F5 Nginx Plus R32 through R36; R32 P6; R36 P4; and 6 more.
Is there a fix for CVE-2026-42945?
A patch was published on 2026-05-13: Fixed versions released for NGINX Open Source and Plus Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42945 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42945?
Check whether you run F5 NGINX App Protect WAF, F5 NGINX Instance Manager, F5 Nginx Ingress Controller or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in src/http/ngx_http_script.c within the ngx_http_rewrite_module. The vulnerability is triggered when a 'rewrite' directive uses an unnamed PCRE capture (e.g., $1, $2) and a replacement string containing a question mark, followed by another rewrite, if, or set directive. The root cause is a mismatch in how NGINX calculates the destination buffer size versus how it performs the actual copy; the script engine fails to clear the 'is_args' flag, leading to URI re-escaping that expands the data beyond the allocated buffer. An unauthenticated remote attacker can exploit this via crafted HTTP requests to cause a worker process crash or achieve remote code execution, particularly if ASLR is disabled or bypassed. Patches are available in NGINX Open Source 1.31.0 and 1.30.1, and NGINX Plus R36 P4 and R32 P6.

Affected products

  • NGINX NGINX Open Source 0.6.27 through 1.30.0
  • NGINX NGINX Plus R32 through R36
  • NGINX NGINX Instance Manager 2.16.0 through 2.21.1
  • NGINX NGINX App Protect WAF 4.9.0 through 4.16.0, 5.1.0 through 5.8.0
  • NGINX NGINX Gateway Fabric 1.3.0 through 1.6.2, 2.0.0 through 2.5.1
  • NGINX NGINX Ingress Controller 3.5.0 through 3.7.2, 4.0.0 through 4.0.1, 5.0.0 through 5.4.1

Timeline

  • 2026-05-13: disclosed: Coordinated disclosure by F5 and depthfirst
  • 2026-05-13: advisory: F5 published security advisory K000161019
  • 2026-05-13: patched: Fixed versions released for NGINX Open Source and Plus

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.