Live › vulnerability › CVE-2026-42945
Go to dashboardA crafted URI with escapable characters makes NGINX's rewrite module write past a heap buffer, because the length and copy passes disagree in ngx_http_script_copy_capture_code(). The result is a worker process crash, and with heap manipulation possibly remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Any NGINX deployment whose config uses a rewrite directive with a ? in the replacement, followed by a set or if that references a capture group, is exposed to crafted requests. The affected version ranges span NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and F5 WAF and DOS products. Teams whose configs have no such rewrite pattern may still be running a vulnerable binary, so upgrading remains the fix.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| f5 dos | vendor | >= 4.3.0, <= 4.7.0 | – |
| f5 dos | vendor | = 4.8.0 | – |
| f5 nginx gateway fabric | vendor | >= 1.3.0, <= 1.6.2 | – |
| f5 nginx gateway fabric | vendor | >= 2.0.0, <= 2.5.1 | – |
| f5 nginx ingress controller | vendor | >= 3.5.0, <= 3.7.2 | – |
| f5 nginx ingress controller | vendor | >= 4.0.0, <= 4.0.1 | – |
| f5 nginx ingress controller | vendor | >= 5.0.0, <= 5.4.1 | – |
| f5 nginx instance manager | vendor | >= 2.16.0, <= 2.21.1 | – |
| f5 nginx open source | vendor | >= 0.6.27, <= 1.30.0 | – |
| f5 nginx plus | vendor | >= r32, <= r36 | – |
| f5 waf | vendor | >= 4.9.0, <= 4.16.0 | – |
| f5 waf | vendor | >= 5.1.0, <= 5.8.0 | – |
| f5 waf | vendor | >= 5.9.0, <= 5.12.1 | – |
nginx -v and compare against the fixed versions listed in the fix field.rewrite directives whose replacement string contains ? followed by set or if that reference capture groups.1.30.1 or later.rewrite directives with ? in the replacement string followed by set or if that reference capture groups.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-05-15 - Emergency · Changelog
New updates and improvements at Cloudflare.
May 15, 2026
This emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's is_args stale-state bug (CVE-2026-42945).
Key Findings
CVE-2026-42945: nginx Heap Buffer Overflow via Stale is_args in Rewrite Module
Successful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in ngx_http_script_copy_capture_code() causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution.
We strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid rewrite directives with ? in the replacement string followed by set or if referencing capture groups.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...7e52be73 | N/A | nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...9df0ee6c | N/A | nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-42945")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.