Vulnerability · Published May 13, 2026 · Assigned by f5
CVE-2026-42945NGINX ngx_http_rewrite_module vulnerability
High 8.1
In plain English
A high-severity heap buffer overflow in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 68.0% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)68.0%top 0.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | nginx | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:10 | nginx-all-modules | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:10 | nginx-all-modules | 2:1.26.3-2.el10_1.2 | ALSA-2026:18063 |
| AlmaLinux:8 | nginx-all-modules | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-all-modules | 2:1.26.3-9.module_el9.8.0+247+aa936373 | ALSA-2026:19372 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:9 | nginx-all-modules | 1:1.24.0-7.module_el9.8.0+246+ef96a02d.1.alma.1 | ALSA-2026:19371 |
| AlmaLinux:10 | nginx-core | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:10 | nginx-filesystem | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:10 | nginx-filesystem | 2:1.26.3-2.el10_1.2 | ALSA-2026:18063 |
| AlmaLinux:8 | nginx-filesystem | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-filesystem | 1:1.24.0-7.module_el9.8.0+246+ef96a02d.1.alma.1 | ALSA-2026:19371 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-filesystem | 2:1.26.3-9.module_el9.8.0+247+aa936373 | ALSA-2026:19372 |
| AlmaLinux:10 | nginx-mod-devel | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:10 | nginx-mod-http-image-filter | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:10 | nginx-mod-http-perl | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:10 | nginx-mod-http-xslt-filter | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:10 | nginx-mod-mail | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| AlmaLinux:10 | nginx-mod-stream | 2:1.26.3-6.el10_2.3 | ALSA-2026:19159 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.24.0-3.module_el8.10.0+4182+ca797750.1.alma.1 | ALSA-2026:18041 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-24.el9_7.3.alma.1 | ALSA-2026:18029 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-28.el9_8.2.alma.1 | ALSA-2026:19374 |
| Alpine:v3.21 | nginx | 1.26.3-r1 | ALPINE-CVE-2026-42945 |
| Alpine:v3.22 | nginx | 1.28.3-r1 | ALPINE-CVE-2026-42945 |
| Alpine:v3.23 | nginx | 1.28.3-r1 | ALPINE-CVE-2026-42945 |
| Alpine:v3.24 | nginx | 1.30.1-r0 | ALPINE-CVE-2026-42945 |
| Debian:12 | nginx | 1.22.1-9+deb12u7 | DEBIAN-CVE-2026-42945 |
| Debian:13 | nginx | 1.26.3-3+deb13u5 | DEBIAN-CVE-2026-42945 |
| Debian:14 | nginx | 1.30.0-3 | DEBIAN-CVE-2026-42945 |
| Rocky Linux:10 | nginx | 2:1.26.3-6.el10_2.3 | RLSA-2026:19159 |
| Rocky Linux:10 | nginx | 2:1.26.3-2.el10_1.2 | RLSA-2026:18063 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40144+38158758 | RLSA-2026:18041 |
| Rocky Linux:9 | nginx | 2:1.20.1-24.el9_7.3.rocky.0.1 | RLSA-2026:18029 |
| Rocky Linux:9 | nginx | 1:1.24.0-7.module+el9.8.0+40193+7b2d11e4.1.rocky.0.1 | RLSA-2026:19371 |
| Rocky Linux:9 | nginx | 2:1.26.3-9.module+el9.8.0+40194+40adfc1b | RLSA-2026:19372 |
| Rocky Linux:9 | nginx | 2:1.20.1-28.el9_8.2.rocky.0.1 | RLSA-2026:19374 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.11 | UBUNTU-CVE-2026-42945 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.8 | UBUNTU-CVE-2026-42945 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.3 | UBUNTU-CVE-2026-42945 |
| Ubuntu:26.04:LTS | nginx | 1.28.3-2ubuntu1.1 | UBUNTU-CVE-2026-42945 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | R36 – before R36 P4R32 – before R32 P6 |
| F5 | NGINX Open Source | 0.6.27 – before 1.30.1 |
Weakness: CWE-122, CWE-131 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://my.f5.com/manage/s/article/K000161019 vendor-advisory, patch
- https://depthfirst.com/nginx-rift
- https://github.com/DepthFirstDisclosures/Nginx-Rift
- https://access.redhat.com/security/cve/CVE-2026-42945 vdb-entry, x_refsource_REDHAT
- RHBZ#2477116 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:17790 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18063 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19159 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18041 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17791 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17751 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17792 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17793 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17752 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17794 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17753 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:18029 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19371 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19372 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17417 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22396 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22393 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22394 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22390 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22388 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22389 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22383 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22382 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20442 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20444 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:58981 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21275 vendor-advisory, x_refsource_REDHAT