NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-28517 | openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process. NVD description · AI analysis pending | 9.3 | 6% | PoC ×2 |
| — | |
| CVE-2026-42945 | Heap Buffer Overflow in NGINX Plus & Open Source rewrite module — DoS, potential RCE NGINX Plus and NGINX Open Source contain a heap buffer overflow (CWE-122, from an incorrect buffer size calculation per CWE-131) in the ngx_http_rewrite_module, triggered when a rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture (e.g., $1, $2) whose replacement string includes a question mark. An unauthenticated remote attacker can trigger the flaw with crafted HTTP requests, but only on servers whose configuration includes this specific directive pattern — hence the high-attack-complexity rating despite the 9.2 CVSS v4.0 score. Successful exploitation causes a heap overflow in the NGINX worker process, crashing it and forcing a restart (availability impact), and can result in code execution on hosts where ASLR is disabled or can be bypassed. All F5 NGINX products built on the NGINX codebase are affected — NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, NGINX WAF, and NGINX App Protect DoS — while versions past End of Technical Support were not evaluated. Exploitation has not yet been confirmed in the wild and the flaw is not in CISA KEV, but a public proof-of-concept ('Nginx-Rift') is available and EPSS assigns a 68% probability of exploitation within 30 days (99th percentile). Do: Upgrade NGINX Plus, NGINX Open Source, and each affected F5 NGINX-derived product (Ingress Controller, Gateway Fabric, Instance Manager, WAF, App Protect DoS) to the patched releases listed in F5's security advisory, noting that EoTS versions were not evaluated and need separate remediation. Interim mitigation: audit nginx configurations for rewrite directives chained with another rewrite, if, or set where unnamed captures ($1, $2, ...) appear in a replacement string containing '?', and remove or restructure those directives (e.g., drop the trailing '?'). Prioritize systems with ASLR disabled, where exploitation could yield remote code execution rather than just a worker-process crash/restart. | 9.2 | 68% | PoC |
| mass≈1,000,000+ internet-exposed NGINX deployments potentially in scope (a smaller subset with the specific rewrite/if/set + unnamed-capture + '?' configuration is… |
Full article539 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 17, 2026Server Security / Vulnerability
A newly disclosed security flaw impacting NGINX Plus and NGINX Open Source has come under active exploitation in the wild, days after its public disclosure, according to VulnCheck.
The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0. According to AI-native security company depthfirst, the vulnerability was introduced in 2008.
Successful exploitation of the flaw can permit an unauthenticated attacker to crash worker processes or execute remote code with crafted HTTP requests. However, it bears noting that code execution is possible only on devices where Address Space Layout Randomization (ASLR), a safeguard against memory-based attacks, is turned off.
"It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it," security researcher Kevin Beaumont said. "To reach RCE [remote code execution], also ASLR needs to have been disabled on the box."
In a similar assessment, AlmaLinux maintainers said: "Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce."
"That said, 'not easy' is not 'impossible,' and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent," the maintainers added.
The latest findings from VulnCheck show that threat actors have begun to weaponize the flaw, with exploitation attempts detected against its honeypot networks. The nature of the attack activity and the end goals are presently unknown. Users are advised to apply the latest fixes from F5 to secure their networks against active threats.
Flaws in openDCIM Also Exploited
The development comes as VulnCheck also revealed exploitation efforts targeting two critical flaws in openDCIM, an open-source application used for data center infrastructure management. The vulnerabilities, both rated 9.3 on the CVSS scoring system, are listed below -
- CVE-2026-28515 - A missing authorization vulnerability that could allow an authenticated user to access LDAP configuration functionality regardless of their assigned privileges. In Docker deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be reachable without credentials, allowing unauthorized modification of application configuration.
- CVE-2026-28517 - An operating system command injection vulnerability impacting the "report_network_map.php" component that processes a parameter called "dot" without sanitization and passes it directly to a shell command, resulting in arbitrary code execution.
The two vulnerabilities were discovered alongside CVE-2026-28516 (CVSS score: 9.3), an SQL injection vulnerability in openDCIM, by VulnCheck security researcher Valentin Lobstein in February 2026. According to Lobstein, the three flaws can be chained to achieve remote code execution over five HTTP requests and spawn a reverse shell.
"The cluster of attacker activity we're observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP web shell," Caitlin Condon, vice president of security research at VulnCheck, said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/05/nginx-cve-2026-42945-exploited-in-wild.html