← Back to Vulnerability Reports CVE Intelligence

CVE-2026-42945

F5 Nginx•HIGH · CVSS 8.1•No exploitation reported

What is CVE-2026-42945?

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS8.1 NVD 3.1
SeverityHIGH
ExploitationNo exploitation reported
EPSS68% · P99
Triage statusNo Known Exploit
ActionPatch within 48 hours
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWECWE-122, CWE-131
NVD published2026-05-13
NVD last modified2026-09-10

Timeline

  • 2026-05-13Published to the U.S. National Vulnerability Database (NVD)
  • 2026-05-18First covered in a defend.network daily briefing
  • 2026-09-10NVD record last updated

Affected product

F5 Nginx

NVD also lists CPE entries for: F5 Dos, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Instance Manager, F5 Nginx Open Source

Remediation Steps

  1. Upgrade NGINX to version 1.30.1 or later immediately
  2. Apply emergency WAF rules to block malformed rewrite module requests
  3. Monitor worker process logs for abnormal terminations and heap memory patterns
  4. Implement rate limiting on HTTP requests during patching window
  5. Validate patches in staging environment prior to production deployment

References

Referenced in our briefings & reports

Related vulnerabilities

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.