CVE-2026-42945NGINX ngx_http_rewrite_module vulnerability
Updated under an hour ago ()
Does this affect you?
It affects F5 NGINX Plus and 16 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-122, CWE-131
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- f5
- NVD analysis
- Modified
- Record last updated
- Sep 10, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
F5 NGINX Plus f5:nginx_plus (from the name) | from R37 not affected; from R36 before R36 P4; from R32 before R32 P6 | CNA record |
F5 NGINX Open Source f5:nginx_open_source (from the name) | from 1.31.0 not affected; from 0.6.27 before 1.30.1 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 2:1.26.3-2.el10_1.2 not affected; from 2:1.26.3-6.el10_2.3 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 2:1.26.3-1.el10_0.9 not affected | CISA ADP |
from 1:1.20.1-10.el9_0.4 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support redhat:rhel_eus | from 1:1.20.1-16.el9_4.6 not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 1.30.1-1.hum1 not affected | CISA ADP |
Red Hat Red Hat Openshift Data Foundation 4.14 redhat:openshift_data_foundation | from 1779972138 not affected | CISA ADP |
Red Hat Red Hat Satellite 6.18 redhat:satellite | from 1779706745 not affected | CISA ADP |
Red Hat Red Hat Update Infrastructure 5 redhat:rhui | from 1779798159 not affected | CISA ADP |
Red Hat Red Hat 3scale API Management Platform 2 redhat:red_hat_3scale_amp | 2 | CISA ADP |
Red Hat Red Hat Lightspeed proxy 1 redhat:insights_proxy | 1 | CISA ADP |
f5 dos f5:dos | from 4.3.0 through 4.7.0; 4.8.0 | NVD |
f5 nginx_gateway_fabric f5:nginx_gateway_fabric | from 1.3.0 through 1.6.2; from 2.0.0 through 2.5.1 | NVD |
f5 nginx_ingress_controller f5:nginx_ingress_controller | from 3.5.0 through 3.7.2; from 4.0.0 through 4.0.1; from 5.0.0 through 5.4.1 | NVD |
f5 nginx_instance_manager f5:nginx_instance_manager | from 2.16.0 through 2.21.1 | NVD |
f5 nginx_open_source f5:nginx_open_source | from 0.6.27 through 1.30.0 | NVD |
f5 nginx_plus f5:nginx_plus | from r32 through r36 | NVD |
f5 waf f5:waf | from 4.9.0 through 4.16.0; from 5.1.0 through 5.8.0; from 5.9.0 through 5.12.1 | NVD |
References
- https://my.f5.com/manage/s/article/K000161019vendor-advisory, patch, mitigation
- https://depthfirst.com/nginx-riftmitigation, technical-description, third-party-advisory
- https://github.com/DepthFirstDisclosures/Nginx-Riftexploit, third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:17417
- https://access.redhat.com/errata/RHSA-2026:17751
- https://access.redhat.com/errata/RHSA-2026:17752
- https://access.redhat.com/errata/RHSA-2026:17753
- https://access.redhat.com/errata/RHSA-2026:17790
- https://access.redhat.com/errata/RHSA-2026:17791
- https://access.redhat.com/errata/RHSA-2026:17792
- https://access.redhat.com/errata/RHSA-2026:17793
- https://access.redhat.com/errata/RHSA-2026:17794
- https://access.redhat.com/errata/RHSA-2026:18029
- https://access.redhat.com/errata/RHSA-2026:18041
- https://access.redhat.com/errata/RHSA-2026:18063
- https://access.redhat.com/errata/RHSA-2026:19159
- https://access.redhat.com/errata/RHSA-2026:19371
- https://access.redhat.com/errata/RHSA-2026:19372
- https://access.redhat.com/errata/RHSA-2026:19374
- https://access.redhat.com/errata/RHSA-2026:20442
- https://access.redhat.com/errata/RHSA-2026:20444
- https://access.redhat.com/errata/RHSA-2026:21275
- https://access.redhat.com/errata/RHSA-2026:22382
- https://access.redhat.com/errata/RHSA-2026:22383
- https://access.redhat.com/errata/RHSA-2026:22388
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.