Vulnerabilitycritical

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

The Hacker Newsby @TheHackersNewsMay 21, 2026 · 07:24 UTC (May 21, 2026)3 min read5 · 4 reads

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-42945 CVE-2026-42946 CVE-2026-40701 CVE-2026-42934

Tags: cve-2026-40701 cve-2026-42934 cve-2026-42945 cve-2026-42946 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-42945 +3 related CVEs CVE-2026-42946 CVE-2026-42934 CVE-2026-40701	Heap Buffer Overflow in NGINX Plus & Open Source rewrite module — DoS, potential RCE	9.2 group max	68%	PoC ×6	May 13, 2026

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  May 14, 2026 Vulnerability / Web Server Cybersecurity researchers have disclosed multiple security vulnerabilities impacting NGINX Plus and NGINX Open, including a critical flaw that remained undetected for 18 years. The vulnerability, discovered by depthfirst , is a heap buffer overflow issue impacting ngx_http_rewrite_module (CVE-2026-42945, CVSS v4 score: 9.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.