PT-2026-40681 · F5 · Nginx Open Source+1

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-42945

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Plus and NGINX Open Source versions 0.6.27 through 1.30.0

Description A heap buffer overflow exists in the ngx http rewrite module module. This occurs when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (such as $1 or $2) with a replacement string containing a question mark (?). An unauthenticated attacker can exploit this by sending crafted HTTP requests, which may cause the NGINX worker process to restart. On systems where Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas of a process—is disabled, code execution is possible.

Recommendations Update to version 1.30.1 or 1.31.0. As a temporary mitigation, adjust the configuration to avoid using the rewrite and set directives in the manner described.

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-42945

Affected Products

Nginx Open Source

Nginx Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42945 · Security Note
• https://my.f5.com/manage/s/article/K000161019 · Patch, Vendor Advisory
• https://twitter.com/takkerohan97/status/2054615751965999174 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2054600092305211489 · Twitter Post
• https://twitter.com/Markak_/status/2054599711764750498 · Twitter Post
• https://twitter.com/andreamichi/status/2054586889269870746 · Twitter Post