CVE-2026-42945

NGINX Plus and NGINX Open Source contain a heap buffer overflow (CWE-122, from an incorrect buffer size calculation per CWE-131) in the ngx_http_rewrite_module, triggered when a rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture (e.g., $1, $2) whose replacement string includes a question mark. An unauthenticated remote attacker can trigger the flaw with crafted HTTP requests, but only on servers whose configuration includes this specific directive pattern — hence the high-attack-complexity rating despite the 9.2 CVSS v4.0 score. Successful exploitation causes a heap overflow in the NGINX worker process, crashing it and forcing a restart (availability impact), and can result in code execution on hosts where ASLR is disabled or can be bypassed. All F5 NGINX products built on the NGINX codebase are affected — NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, NGINX WAF, and NGINX App Protect DoS — while versions past End of Technical Support were not evaluated. Exploitation has not yet been confirmed in the wild and the flaw is not in CISA KEV, but a public proof-of-concept ('Nginx-Rift') is available and EPSS assigns a 68% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade NGINX Plus, NGINX Open Source, and each affected F5 NGINX-derived product (Ingress Controller, Gateway Fabric, Instance Manager, WAF, App Protect DoS) to the patched releases listed in F5's security advisory, noting that EoTS versions were not evaluated and need separate remediation. Interim mitigation: audit nginx configurations for rewrite directives chained with another rewrite, if, or set where unnamed captures ($1, $2, ...) appear in a replacement string containing '?', and remove or restructure those directives (e.g., drop the trailing '?'). Prioritize systems with ASLR disabled, where exploitation could yield remote code execution rather than just a worker-process crash/restart.