{"id":"CVE-2026-42945","title":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module","summary":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expre…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-122","CWE-131"],"vendor":"f5","product":"dos","affected":["dos >= 4.3.0, <= 4.7.0","dos = 4.8.0","nginx_gateway_fabric >= 1.3.0, <= 1.6.2","nginx_gateway_fabric >= 2.0.0, <= 2.5.1","nginx_ingress_controller >= 3.5.0, <= 3.7.2","nginx_ingress_controller >= 4.0.0, <= 4.0.1","nginx_ingress_controller >= 5.0.0, <= 5.4.1","nginx_instance_manager >= 2.16.0, <= 2.21.1","nginx_open_source >= 0.6.27, <= 1.30.0","nginx_plus >= r32, <= r36","waf >= 4.9.0, <= 4.16.0","waf >= 5.1.0, <= 5.8.0","waf >= 5.9.0, <= 5.12.1"],"patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","hardened_images","openshift_data_foundation 4.14","openshift_data_foundation 4.15","openshift_data_foundation 4.16","openshift_data_foundation 4.17","openshift_data_foundation 4.18","openshift_data_foundation 4.19","openshift_data_foundation 4.20","openshift_data_foundation 4.21","satellite 6.18","satellite 6.19","update_infrastructure 5"],"published":"2026-05-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:09.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","references":[{"url":"https://my.f5.com/manage/s/article/K000161019","label":"f5sirt@f5.com"},{"url":"https://depthfirst.com/nginx-rift","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/DepthFirstDisclosures/Nginx-Rift","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:17417","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17751","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17752","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17753","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17790","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17791","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17792","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17793","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17794","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18029","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18041","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:18063","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19159","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19371","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19372","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19374","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20442","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20444","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22382","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22383","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22388","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22389","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22390","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22393","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22394","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22396","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42945","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477116","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42945"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-05-13T00:00:00+00:00"},"epss":0.68047,"epssPercentile":0.99316,"exploits":{"github":44,"githubRepos":["https://github.com/cipherspy/CVE-2026-42945-POC","https://github.com/friparia/NGINX_RIFT_SCAN_CVE_2026_42945","https://github.com/MateusVerass/nGixshell"],"checkedAt":"2026-09-21T15:28:55.255Z"},"exploitAvailable":true,"ingestedAt":"2026-09-07T14:12:12.910Z","slug":"CVE-2026-42945","body":"## Overview\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n## Affected\n\n- `dos >= 4.3.0, <= 4.7.0`\n- `dos = 4.8.0`\n- `nginx_gateway_fabric >= 1.3.0, <= 1.6.2`\n- `nginx_gateway_fabric >= 2.0.0, <= 2.5.1`\n- `nginx_ingress_controller >= 3.5.0, <= 3.7.2`\n- `nginx_ingress_controller >= 4.0.0, <= 4.0.1`\n- `nginx_ingress_controller >= 5.0.0, <= 5.4.1`\n- `nginx_instance_manager >= 2.16.0, <= 2.21.1`\n- `nginx_open_source >= 0.6.27, <= 1.30.0`\n- `nginx_plus >= r32, <= r36`\n- `waf >= 4.9.0, <= 4.16.0`\n- `waf >= 5.1.0, <= 5.8.0`\n- `waf >= 5.9.0, <= 5.12.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:17790** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17790)\n- **RHSA-2026:18063** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18063)\n- **RHSA-2026:19159** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19159)\n- **RHSA-2026:18041** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18041)\n- **RHSA-2026:17791** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.0) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17791)\n- **RHSA-2026:17751** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17751)\n- **RHSA-2026:17792** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17792)\n- **RHSA-2026:17793** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17793)\n- **RHSA-2026:17752** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17752)\n- **RHSA-2026:17794** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17794)\n- **RHSA-2026:17753** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-05-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:17753)\n- **Red Hat VEX** · Critical · affected: Red Hat Lightspeed proxy 1 · no fix planned: Red Hat Lightspeed proxy 1 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json)","depth":"midnight","depthScore":70,"depthScoreParts":{"impact":44.6,"likelihood":13.6,"exploitation":12,"ransomware":0},"changes":[{"seq":5212,"id":"CVE-2026-42945","ts":1788887253743,"field":"exploit_available","old":"false","new":"true"},{"seq":4095,"id":"CVE-2026-42945","ts":1788886369627,"field":"exploit_available","old":"true","new":"false"},{"seq":2872,"id":"CVE-2026-42945","ts":1788883035919,"field":"exploit_available","old":"false","new":"true"},{"seq":1901,"id":"CVE-2026-42945","ts":1788882439056,"field":"exploit_available","old":"true","new":"false"},{"seq":995,"id":"CVE-2026-42945","ts":1788881873404,"field":"exploit_available","old":"false","new":"true"}]}