- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,581
The weak spot worked only under special conditions, but the consequences could be rigid.
NGINX found an error that for years could live quietly in the server settings and not attract attention. The vulnerability affects the address rewrite module and, with a certain configuration, allows the attacker without a password and account to bring down the workflow, and in some cases, the code remotely.
The problem was received by the CVE-2026-42945 identifier and a 9.2 on the CVSS v4 scale. The depthfirst team called the vulnerability NGINX Rift. The error is associated with the overflow of the buffer in the module ngx_http_rewrite_module. The attack requires a specially formed HTTP request and a certain combination of settings: rewrite directives, if or set, unnamed PCRE captures like $1 or $2 and a replacement line with a question mark.
According to depthfirst, the vulnerable code appeared in NGINX back in 2008 and reached versions of 1.30.0 inclusive. The team separately took up CVE-2026-42945 due to a rare combination of high danger and a long life of error in the project through which a huge amount of web traffic passes. The problem has experienced many releases, new server configurations and years of active use of the rewrite module.
According to F5, the failure occurs in the NGINX workflow. When the randomization of the addressy space is turned on, the attack more often leads to a restart of the process and failure to maintain. If the ASLR is disabled, the risk becomes higher – an attacker can achieve remote execution of the code.
depth first indicates that CVE-2026-42945 is particularly dangerous due to lack of authorization. The attacker has enough access to a vulnerable server over HTTP. Extra data that fall outside the allocated memory are formed from the URI of the attacker, so memory damage can be controlled. Repeated requests are able to again and again drop out of work processes and interfere with the work of all sites on the same instance.
Corrections are released for NGINX Open Source 1.30.1 and 1.31.0, as well as for NGINX Plus R32 P6 and R36 P4. The error affects the NGINX Open Source from 1.0.0 to 1.30.0, and for the old branch 0.6.27-0.9.7, no corrections are planned. The list of vulnerable products also included NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, solutions for protection against DoS, NGINX Gateway Fabric and NGINX Ingress Controller.
Together with CVE-2026-42945, three more vulnerabilities were closed in NGINX. CVE-2026-42946 is associated with excessive memory selection in the SCGI and uWSGI modules. CVE-2026-40701 affects the SSL module and can cause data damage or restart the process when individual client certificate checkup and OCSP settings. CVE-2026-42934 allows you to read data outside the buffer in the charset module in a specific configuration.
Administrators are advised to switch to corrected versions. If it is not possible to update quickly, F5 advises to protect against CVE-2026-42945 to amend the rewrite rules and replace unnamed grips with names in all affected directives.
NGINX found an error that for years could live quietly in the server settings and not attract attention. The vulnerability affects the address rewrite module and, with a certain configuration, allows the attacker without a password and account to bring down the workflow, and in some cases, the code remotely.
The problem was received by the CVE-2026-42945 identifier and a 9.2 on the CVSS v4 scale. The depthfirst team called the vulnerability NGINX Rift. The error is associated with the overflow of the buffer in the module ngx_http_rewrite_module. The attack requires a specially formed HTTP request and a certain combination of settings: rewrite directives, if or set, unnamed PCRE captures like $1 or $2 and a replacement line with a question mark.
According to depthfirst, the vulnerable code appeared in NGINX back in 2008 and reached versions of 1.30.0 inclusive. The team separately took up CVE-2026-42945 due to a rare combination of high danger and a long life of error in the project through which a huge amount of web traffic passes. The problem has experienced many releases, new server configurations and years of active use of the rewrite module.
According to F5, the failure occurs in the NGINX workflow. When the randomization of the addressy space is turned on, the attack more often leads to a restart of the process and failure to maintain. If the ASLR is disabled, the risk becomes higher – an attacker can achieve remote execution of the code.
depth first indicates that CVE-2026-42945 is particularly dangerous due to lack of authorization. The attacker has enough access to a vulnerable server over HTTP. Extra data that fall outside the allocated memory are formed from the URI of the attacker, so memory damage can be controlled. Repeated requests are able to again and again drop out of work processes and interfere with the work of all sites on the same instance.
Corrections are released for NGINX Open Source 1.30.1 and 1.31.0, as well as for NGINX Plus R32 P6 and R36 P4. The error affects the NGINX Open Source from 1.0.0 to 1.30.0, and for the old branch 0.6.27-0.9.7, no corrections are planned. The list of vulnerable products also included NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, solutions for protection against DoS, NGINX Gateway Fabric and NGINX Ingress Controller.
Together with CVE-2026-42945, three more vulnerabilities were closed in NGINX. CVE-2026-42946 is associated with excessive memory selection in the SCGI and uWSGI modules. CVE-2026-40701 affects the SSL module and can cause data damage or restart the process when individual client certificate checkup and OCSP settings. CVE-2026-42934 allows you to read data outside the buffer in the charset module in a specific configuration.
Administrators are advised to switch to corrected versions. If it is not possible to update quickly, F5 advises to protect against CVE-2026-42945 to amend the rewrite rules and replace unnamed grips with names in all affected directives.
