Nginx Rift: Silent RCE -CVE-2026-42945

Overview

CVE-2026-42945, dubbed Nginx Rift, is a critical heap buffer overflow residing in NGINX's ngx_http_rewrite_module — a component present in virtually every NGINX deployment since version 0.6.27 (2008). The vulnerability enables unauthenticated remote code execution and affects NGINX Open Source up to 1.30.0 and NGINX Plus up to R36.

Root Cause

NGINX's rewrite script engine uses a two-pass architecture:

• Pass 1 (length calculation): Runs on a freshly initialized sub-engine where is_args = 0. Returns raw capture length for buffer allocation.
• Pass 2 (data copy): Executes on the main engine where is_args = 1 — set when a rewrite replacement contains ?. Calls ngx_escape_uri() with NGX_ESCAPE_ARGS, expanding each escapable byte to 3 bytes.

The buffer allocated in Pass 1 is undersized relative to what Pass 2 actually writes. The result is a heap buffer overflow with attacker-controlled URI data.

Affected Versions

Exploitation

Successful exploitation involves:

1. Heap feng shui via cross-request spraying — POST bodies are used to position ngx_pool_t structures adjacent to the overflow target (URI bytes cannot contain null bytes, so POST body spray is required).
2. Cleanup pointer corruption on the adjacent pool — overwriting ngx_pool_cleanup_s->handler to point to system().
3. Pool destruction trigger — on request teardown, NGINX walks the cleanup chain and executes the attacker-supplied command.

Remediation

Immediate: Upgrade to NGINX Open Source 1.30.1 / 1.31.0 or NGINX Plus R36 P4 / R35 P2 / R32 P6.

Interim mitigations if upgrade is not immediately possible:

• Audit all rewrite directives containing ? in replacement strings.
• Deploy a WAF rule blocking URI patterns with high concentrations of %-encoded sequences targeting rewrite endpoints.
• Monitor for anomalous worker process crashes (segfault in /var/log/nginx/error.log).

Vendor advisory: https://my.f5.com/manage/s/article/K000160932

References

• NVD: CVE-2026-42945
• DepthFirst Technical Write-up: https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability
• GitHub PoC: https://github.com/depthfirstdisclosures/nginx-rift