CVE-2026-42945

Published May 13, 2026

Last updated 3 days ago

CVSS critical 9.2

NGINX

Openresty

Ubuntu

ICS

Port (443)

HTTP

NGINX Plus

NGINX Open Source

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42945 is a heap buffer overflow vulnerability found in the `ngx_http_rewrite_module` of NGINX Plus and NGINX Open Source. This flaw occurs when a `rewrite` directive is immediately followed by another `rewrite`, `if`, or `set` directive, and an unnamed Perl-Compatible Regular Expression (PCRE) capture (such as `$1` or `$2`) is used within a replacement string that contains a question mark (`?`). An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests. This can lead to a heap buffer overflow in the NGINX worker process, causing it to restart. Additionally, on systems where Address Space Layout Randomization (ASLR) is disabled, this vulnerability could potentially allow for code execution.

Description: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: f5sirt@f5.com
NVD status: Modified
Products: dos, nginx_gateway_fabric, nginx_ingress_controller, nginx_instance_manager, nginx_open_source, nginx_plus, waf

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

f5sirt@f5.com: CWE-122
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-131

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "0772572C-26F9-4FA4-B9E6-BA40ED59F569",
            "versionEndIncluding": "4.7.0",
            "versionStartIncluding": "4.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "C45452BD-7A86-48E7-8E1D-1B340FF70B3B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE",
            "versionEndIncluding": "1.6.2",
            "versionStartIncluding": "1.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CE4363AD-0E25-4A27-A45B-A436605626F0",
            "versionEndIncluding": "2.5.1",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "10D5B143-4C1E-4626-8B49-3EA7160E9256",
            "versionEndIncluding": "3.7.2",
            "versionStartIncluding": "3.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "73A1CDBB-49F6-4AB6-AA67-542FD8017D6A",
            "versionEndIncluding": "4.0.1",
            "versionStartIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "653E97B6-7BC8-4427-B875-F19E9CE6A04B",
            "versionEndIncluding": "5.4.1",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "32EC06F0-3263-43FF-B855-EF903E6FFE7C",
            "versionEndIncluding": "2.21.1",
            "versionStartIncluding": "2.16.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "35DC1B89-E400-429C-9360-303F69D2BF3A",
            "versionEndIncluding": "1.30.0",
            "versionStartIncluding": "0.6.27",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0B153576-468F-48C2-9BC8-922A938AB235",
            "versionEndIncluding": "r36",
            "versionStartIncluding": "r32",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "F365BA5A-42D7-4024-9143-06D4DEE31212",
            "versionEndIncluding": "4.16.0",
            "versionStartIncluding": "4.9.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "8D720985-9119-480E-929A-7D9D5C083628",
            "versionEndIncluding": "5.8.0",
            "versionStartIncluding": "5.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "DE69C522-7FCB-4452-8E33-FCC72D36BF94",
            "versionEndIncluding": "5.12.1",
            "versionStartIncluding": "5.9.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.