The discovery of a critical vulnerability in NGINX that remained hidden for 18 years has raised serious concerns in the cybersecurity community. The vulnerability, codenamed NGINX Rift, allows unauthenticated attackers to execute remote code or cause a denial of service via malicious requests. The fact that this vulnerability has existed undetected since 2008 highlights the challenges security researchers face in identifying deeply embedded issues in critical internet infrastructure.
See also: Flowise: Critical vulnerability allows RCE via MCP Adapters
Cybersecurity researchers at depthfirst have discovered this serious vulnerability affecting both NGINX Plus and NGINX Open Source. The vulnerability, CVE-2026-42945 , with a CVSS v4 score of 9.2, concerns a heap buffer overflow in the ngx_http_rewrite_module and is one of the most serious threats ever identified in the popular web server. The high CVSS score reflects the severity of the threat, as it combines the ease of exploitation with the devastating consequences it can have on affected services.
According to the F5 announcement, the vulnerability occurs when the rewrite directive is followed by rewrite, if, or set directives and an anonymous Perl-Compatible Regular Expression (PCRE) capture with a replacement string that includes a semicolon. This particular configuration, which is quite common in many NGINX installations, creates the conditions for exploitation of the vulnerability. The widespread use of such configurations in production environments makes the threat particularly serious, as millions of websites worldwide could be vulnerable.
Most worryingly, the attack can be carried out without any form of authentication. An attacker who can reach a vulnerable NGINX server via HTTP can send a single request that causes a heap overflow in the worker process and achieves remote code execution. No authentication step, prior access, or existing session is required. This means that anyone with network access to the server can potentially exploit the vulnerability, making the threat highly accessible to malicious actors.
Technical details and impact of NGINX Rift
The NGINX Rift vulnerability is particularly dangerous because the bytes written beyond the allocation come from the attacker's URI, meaning the corruption is attacker-configured and not random. Repeated requests can also be used to keep workers in a crash cycle and degrade availability for any website served by the installation. The ability to control the data that causes the corruption gives attackers a significant advantage in constructing credible exploits.
See also: Critical vulnerability in Nginx UI exposes backups
The vulnerability affects systems that have Address Space Layout Randomization (ASLR), where code execution is possible. However, even on systems with ASLR enabled, the vulnerability can cause a worker process to restart, leading to a denial of service. In high-availability environments, even temporary service outages can have significant financial and operational impacts.
In addition to the main vulnerability CVE-2026-42945, researchers identified three additional serious vulnerabilities. CVE-2026-42946 , with a score of 8.3, concerns excessive memory allocation in the ngx_http_scgi_module and ngx_http_uwsgi_module, allowing attackers with adversary-in-the-middle capabilities to inspect responses from upstream servers. This vulnerability is particularly concerning in environments where NGINX is used as a reverse proxy or load balancer.
CVE -2026-40701, rated 6.3, is a use-after-free vulnerability in ngx_http_ssl_module that can be exploited when the ssl_verify_client and ssl_ocsp directives are enabled. Finally, CVE-2026-42934 , also rated 6.3, is an out-of-bounds read in ngx_http_charset_module that can reveal memory contents. The combined impact of these vulnerabilities creates a complex threat landscape that requires immediate attention.
Defense strategies and advanced protection measures
For organizations that cannot immediately apply the updates, there are several mitigation strategies. Implementing Web Application Firewalls (WAFs) with rules that detect suspicious patterns in URI requests can provide temporary protection. Additionally, monitoring NGINX logs for unusual activity, such as frequent worker process restarts or unexpected crash patterns, can help identify exploitation attempts early. Enabling detailed logging and using SIEM tools to analyze the data are critical components of a comprehensive defense strategy.
Protection measures and recommendations for the NGINX vulnerability
F5 has released updates that address all vulnerabilities since the responsible disclosure on April 21, 2026. System administrators are advised to apply the latest versions immediately for optimal protection. The update process should include extensive testing in staging environments before applying to production systems.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In case immediate patching is not possible for CVE-2026-42945, users are advised to modify the rewrite configuration by replacing anonymous captures with named captures in each affected rewrite directive. This temporary solution can significantly reduce the risk of exploitation, but is not a permanent solution.
See also: Nginx: Critical bug in nginx-ui allows complete server takeover
The discovery of these vulnerabilities highlights the importance of ongoing security analysis even for mature technologies like NGINX. Organizations using NGINX should prioritize the implementation of security updates and consider implementing additional protection measures such as Web Application Firewalls for additional security.
