NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
Summary: A heap buffer overflow in NGINX's ngx_http_rewrite_module, tracked as CVE-2026-42945 with a CVSS score of 9.2, affects NGINX versions 0.6.27 through 1.30.0 and was introduced in 2008, according to depthfirst. VulnCheck reports active exploitation attempts against its honeypot networks days after public disclosure, with unauthenticated attackers able to crash worker processes or, only where ASLR is disabled, execute remote code via crafted HTTP requests.
Bottom line: The flaw has sat in NGINX since 2008, and exploitation requires a specific configuration an attacker must know or discover - yet VulnCheck is already seeing attempts in the wild, and AlmaLinux maintainers call the worker-crash denial-of-service exploitable enough on its own to treat as urgent.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-28516CVE-2026-42945
- Related