{"id":"CVE-2026-42945","kind":"vulnerability","aliases":["CVE-2026-42945"],"related":[],"title":"NGINX: rewrite module heap overflow lets remote requests crash workers or run code","description":"WAF Release - 2026-05-15 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 15, 2026\n\n## WAF Release - 2026-05-15 - Emergency\n\nThis emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's `is_args` stale-state bug (CVE-2026-42945).\n\nKey Findings\n\nCVE-2026-42945: nginx Heap Buffer Overflow via Stale `is_args` in Rewrite Module\n\nSuccessful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in `ngx_http_script_copy_capture_code()` causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution.\n\nWe strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` referencing capture groups.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...7e52be73 | N/A | nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9df0ee6c | N/A | nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |","summary":"A crafted URI with escapable characters makes NGINX's rewrite module write past a heap buffer, because the length and copy passes disagree in ngx_http_script_copy_capture_code(). The result is a worker process crash, and with heap manipulation possibly remote code execution.","severity":"critical","cvss":9.2,"epss":0.03396,"exploited":false,"exploited_at":null,"products":[{"name":"f5 dos","fixed":[],"affected":">= 4.3.0, <= 4.7.0","ecosystem":"vendor"},{"name":"f5 dos","fixed":[],"affected":"= 4.8.0","ecosystem":"vendor"},{"name":"f5 nginx gateway fabric","fixed":[],"affected":">= 1.3.0, <= 1.6.2","ecosystem":"vendor"},{"name":"f5 nginx gateway fabric","fixed":[],"affected":">= 2.0.0, <= 2.5.1","ecosystem":"vendor"},{"name":"f5 nginx ingress controller","fixed":[],"affected":">= 3.5.0, <= 3.7.2","ecosystem":"vendor"},{"name":"f5 nginx ingress controller","fixed":[],"affected":">= 4.0.0, <= 4.0.1","ecosystem":"vendor"},{"name":"f5 nginx ingress controller","fixed":[],"affected":">= 5.0.0, <= 5.4.1","ecosystem":"vendor"},{"name":"f5 nginx instance manager","fixed":[],"affected":">= 2.16.0, <= 2.21.1","ecosystem":"vendor"},{"name":"f5 nginx open source","fixed":[],"affected":">= 0.6.27, <= 1.30.0","ecosystem":"vendor"},{"name":"f5 nginx plus","fixed":[],"affected":">= r32, <= r36","ecosystem":"vendor"},{"name":"f5 waf","fixed":[],"affected":">= 4.9.0, <= 4.16.0","ecosystem":"vendor"},{"name":"f5 waf","fixed":[],"affected":">= 5.1.0, <= 5.8.0","ecosystem":"vendor"},{"name":"f5 waf","fixed":[],"affected":">= 5.9.0, <= 5.12.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["api-gateway","cloudflare","ingress","kubernetes","lab-disclosure","nginx","runtime","self-hosted"],"not_affected_if":["default-config","no-rewrite-with-query-string"],"how_to_check":"- Run `nginx -v` and compare against the fixed versions listed in the fix field.\n- Search configs for `rewrite` directives whose replacement string contains `?` followed by `set` or `if` that reference capture groups.\n- For NGINX Ingress, NGINX Gateway Fabric, or NGINX Instance Manager, check the controller or product version rather than the nginx binary.","fix":"- NGINX Open Source: upgrade to `1.30.1` or later.\n- NGINX Plus: move to the fixed release from F5's advisory (unknown in the sources).\n- NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF and DOS: the fixed versions are unknown in the sources.\n- Interim mitigation if upgrading is not possible: avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` that reference capture groups.","status":"open","published_at":"2026-05-13T16:16:50+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:23+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:29:23Z","model":"claude-haiku-5-5","output":{"fix":"- NGINX Open Source: upgrade to `1.30.1` or later.\n- NGINX Plus: move to the fixed release from F5's advisory (unknown in the sources).\n- NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF and DOS: the fixed versions are unknown in the sources.\n- Interim mitigation if upgrading is not possible: avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` that reference capture groups.","reach":"internet","title":"NGINX: rewrite module heap overflow lets remote requests crash workers or run code","impact":"high","summary":"A crafted URI with escapable characters makes NGINX's rewrite module write past a heap buffer, because the length and copy passes disagree in ngx_http_script_copy_capture_code(). The result is a worker process crash, and with heap manipulation possibly remote code execution.","category":"runtime","nicknames":[],"who_cares":["nginx","self-hosted","kubernetes","ingress","api-gateway"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker crashes worker processes or possibly runs code on the server.","analyst_note":"Fixed versions for NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager and WAF are not in the sources; check the F5 advisory for CVE-2026-42945.","how_to_check":"- Run `nginx -v` and compare against the fixed versions listed in the fix field.\n- Search configs for `rewrite` directives whose replacement string contains `?` followed by `set` or `if` that reference capture groups.\n- For NGINX Ingress, NGINX Gateway Fabric, or NGINX Instance Manager, check the controller or product version rather than the nginx binary.","needs_analyst":true,"not_affected_if":["default-config","no-rewrite-with-query-string"],"who_is_affected":"Any NGINX deployment whose config uses a rewrite directive with a `?` in the replacement, followed by a `set` or `if` that references a capture group, is exposed to crafted requests. The affected version ranges span NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and F5 WAF and DOS products. Teams whose configs have no such rewrite pattern may still be running a vulnerable binary, so upgrading remains the fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00089,"input_tokens":4412,"output_tokens":897,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-05':123C,140C '-15':124C,141C '-2026':15A,18A,173C,178C,321C,343C '-42945':16A,19A,174C,179C,322C,344C '1.30.1':265C '15':135C '2026':122C,136C,139C '7e52':310C '9df0ee6c':333C 'action':303C,305C 'address':270C 'allow':193C 'api':62B 'api-gateway':61B 'arg':167C,187C 'attack':195C 'attempt':160C 'avoid':279C 'be73':311C 'block':324C,346C 'buffer':90B,154C,182C,200C,236C,317C 'bug':171C 'cannot':276C 'captur':103B,223C,293C 'caus':225C 'changelog':126C,127C 'charact':80B,213C 'cloudflar':64B,133C,307C,330C 'code':13A,104B,118B,224C,257C,315C,337C 'comment':306C 'contain':211C 'controller':35A,39A,43A 'copi':95B,102B,222C,227C 'corrupt':240C 'craft':76B,209C 'crash':9A,111B,248C 'cve':14A,17A,172C,177C,319C,320C,341C,342C 'data':232C 'denial':243C 'descript':301C 'detect':151C,329C,351C 'direct':281C 'disagre':97B 'disclosur':69B 'dos':21A,23A 'emerg':125C,142C,144C 'enabl':242C 'escap':79B,212C,231C 'execut':119B,258C,316C,338C 'exploit':159C,192C 'f5':20A,22A,24A,28A,32A,36A,40A,44A,48A,52A,55A,57A,59A 'fabric':27A,31A 'feng':252C 'find':176C 'follow':287C 'gateway':26A,30A,63B 'group':294C 'heap':4A,89B,114B,153C,157C,181C,199C,239C,251C,339C 'host':74B 'http':100B,220C 'id':297C,300C 'immedi':268C,278C 'improv':131C 'ingress':34A,38A,42A,65B 'instance':46A 'introduc':146C 'key':175C 'kubernet':66B 'lab':68B 'lab-disclosur':67B 'later':267C 'lead':237C 'legaci':298C 'length':93B 'length/copy':215C 'let':6A 'make':81B 'manag':308C,331C 'manager':47A 'manipul':115B 'may':134C 'mismatch':217C 'modul':3A,85B,164C,190C,206C 'n/a':312C,323C,334C,345C 'new':128C,148C,304C,328C,350C 'nginx':1A,25A,29A,33A,37A,41A,45A,49A,53A,70B,82B,152C,180C,203C,264C,313C,335C 'ngx':99B,219C 'open':50A 'overflow':5A,155C,183C,201C 'overread':318C 'pass':96B,216C,228C 'past':87B 'plus':54A 'possibl':116B 'potenti':255C 'previous':302C 'process':110B,247C 'recommend':261C 'referenc':292C 'releas':121C,138C,145C 'remot':7A,117B,194C,256C,314C,336C 'replac':285C 'request':8A 'result':106B 'rewrit':2A,84B,163C,189C,205C,280C 'rule':149C,296C,299C 'ruleset':295C,309C,332C 'run':12A 'runtim':71B 'script':101B,221C 'self':73B 'self-host':72B 'send':208C 'servic':245C 'set':289C 'shui':253C 'source':51A 'spray':158C,340C 'stale':169C,185C 'stale-st':168C 'state':170C 'string':286C 'strong':260C 'success':191C 'target':161C 'techniqu':254C 'trigger':197C 'two':147C 'under':272C 'unders':235C 'updat':129C 'upgrad':262C,277C 'uri':77B,210C 'via':184C 'vulner':273C 'waf':56A,58A,60A,120C,137C 'worker':10A,109B,246C 'write':86B,230C","nicknames":[],"mitigations":[],"who_affected":"Any NGINX deployment whose config uses a rewrite directive with a `?` in the replacement, followed by a `set` or `if` that references a capture group, is exposed to crafted requests. The affected version ranges span NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and F5 WAF and DOS products. Teams whose configs have no such rewrite pattern may still be running a vulnerable binary, so upgrading remains the fix.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-13T16:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f5sirt@f5.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-05-15-emergency-waf-release/#CVE-2026-42945","url":"https://developers.cloudflare.com/changelog/post/2026-05-15-emergency-waf-release/","severity":null,"published_at":"2026-05-15T18:56:02+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF Release - 2026-05-15 - Emergency · Changelog"},{"source":"nvd","external_id":"CVE-2026-42945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","severity":null,"published_at":"2026-05-13T16:16:50+00:00","modified_at":"2026-09-10T13:20:09+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-42945","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42945","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2905,"url":"https://developers.cloudflare.com/changelog/post/2026-05-15-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-05-15 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-05-15 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 15, 2026\n\n## WAF Release - 2026-05-15 - Emergency\n\nThis emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's `is_args` stale-state bug (CVE-2026-42945).\n\nKey Findings\n\nCVE-2026-42945: nginx Heap Buffer Overflow via Stale `is_args` in Rewrite Module\n\nSuccessful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in `ngx_http_script_copy_capture_code()` causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution.\n\nWe strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` referencing capture groups.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...7e52be73 | N/A | nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9df0ee6c | N/A | nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. |","published_at":"2026-05-15T18:56:02+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}