NGINX Rift: Critical Heap Buffer Overflow in NGINX (CVE-2026-42945)

On May 13, 2026, details emerged regarding a critical heap buffer overflow in NGINX, dubbed "NGINX Rift" (CVE-2026-42945). The flaw exists in the ngx_http_rewrite_module and is triggered by specific configuration patterns involving unnamed PCRE captures and rewrite directives. While NGINX is notoriously resilient, this vulnerability allows unauthenticated remote attackers to crash worker processes or potentially achieve remote code execution (RCE) by manipulating URI escaping logic during script execution.

The vulnerability stems from a state mismatch in the NGINX script engine where buffer length is calculated for raw bytes but data is copied as escaped bytes, leading to an overflow. This 18-year-old bug affects a wide range of NGINX Open Source (0.6.27 to 1.30.0), NGINX Plus, and F5-derived products. Although RCE is complex and requires specific environmental conditions like disabled ASLR, the denial-of-service (DoS) potential is high and trivial to exploit.

Organizations should prioritize patching NGINX binaries and restarting all worker processes. For environments where immediate patching is not feasible, configuration-level mitigations—specifically moving from unnamed to named PCRE captures—can effectively close the known attack vector.