NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Configurations
Configuration 1 (hide)
|
History
27 Jun 2026, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-131 | |
| References |
|
18 Jun 2026, 14:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:* cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* |
|
| References | () https://my.f5.com/manage/s/article/K000161019 - Mitigation, Vendor Advisory | |
| References | () https://depthfirst.com/nginx-rift - Mitigation, Technical Description, Third Party Advisory | |
| References | () https://github.com/DepthFirstDisclosures/Nginx-Rift - Exploit, Third Party Advisory | |
| First Time |
F5 nginx Open Source
F5 nginx Ingress Controller F5 nginx Instance Manager F5 dos F5 waf F5 nginx Gateway Fabric F5 nginx Plus F5 |
21 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
14 May 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 May 2026, 02:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 May 2026, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 16:16
Updated : 2026-07-15 02:21
NVD link : CVE-2026-42945
Mitre link : CVE-2026-42945
CVE.ORG link : CVE-2026-42945
JSON object : View
Products Affected
f5
- dos
- nginx_open_source
- nginx_plus
- nginx_ingress_controller
- nginx_gateway_fabric
- nginx_instance_manager
- waf