PT-2026-40681 · F5+5 · Nginx Open Source+6
Published
2026-05-13
·
Updated
2026-07-13
·
CVE-2026-42945
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NGINX Plus and NGINX Open Source versions 0.6.27 through 1.30.0
Description
A heap buffer overflow exists in the
ngx http rewrite module of NGINX. The issue occurs when a rewrite directive is followed by a rewrite, if, or set directive and utilizes an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g., $1, $2) with a replacement string containing a question mark (?). The root cause is an inconsistent state management in the internal rewrite engine where an is args flag remains enabled between the memory allocation pass and the data copy pass, leading to an out-of-bounds write when processing escaped URI characters.An unauthenticated remote attacker can exploit this by sending crafted HTTP requests. This typically results in a denial of service (DoS) due to the NGINX worker process crashing and restarting. However, if Address Space Layout Randomization (ASLR), a security technique that randomizes memory addresses to prevent exploitation, is disabled, the attacker may achieve arbitrary code execution. Approximately 5.7 million internet-facing servers were estimated to be potentially vulnerable, and real-world exploitation has been observed shortly after public disclosure.
Recommendations
Update NGINX Open Source to versions 1.30.1 or 1.31.0.
Update NGINX Plus to versions 37.0.0, R36 P4, or R32 P6.
As a temporary mitigation, replace all unnamed PCRE captures with named captures in the affected
rewrite, if, or set directives.Exploit
Fix
RCE
DoS
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Nginx Open Source
Nginx Plus
Nginx
Red Os
Rocky Linux
Ubuntu