NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-28517+2 related CVEs | openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php | 9.3 | 6% | PoC ×2 | |
| CVE-2026-42945 | Heap Buffer Overflow in NGINX Plus & Open Source rewrite module — DoS, potential RCE | 9.2 | 68% | PoC ×6 |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan May 17, 2026 Server Security / Vulnerability A newly disclosed security flaw impacting NGINX Plus and NGINX Open Source has come under active exploitation in the wild, days after its public disclosure, according to VulnCheck . The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9. 2), is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.