18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE
Summary: Researchers at depthfirst disclosed CVE-2026-42945, a heap buffer overflow in NGINX's ngx_http_rewrite_module with a CVSS v4 score of 9.2 that went undetected for 18 years, affecting NGINX Plus and NGINX Open Source. F5 said the flaw is reachable by an unauthenticated attacker sending crafted HTTP requests when a rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture with a replacement string containing a question mark, and it was addressed after responsible disclosure on April 21, 2026.
Key Takeaway: A single unauthenticated request can overflow the worker process heap, and a released proof-of-concept includes an ASLR-bypass chain that achieves remote code execution without the original hardcoded addresses - so the window between disclosure and exploitation is already closed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-42945
- Related