CVE-2026-42945

High · CVSS 8.1

NGINX Plus and NGINX Open Source — Heap buffer overflow via PCRE capture in rewrite module (potential RCE)

CVSS: 8.1; nvd
EPSS: 66.0%; 99th pct
KEV: No
Class: oss containerizable; CWE-122, CWE-131

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Search profile — drives PoC discovery

Symbols ngx_http_rewrite_modulerewrite directivePCRE capture$1$2replacement stringquestion markngx_http_rewrite_handlerngx_http_script_compilengx_pallocngx_http_rewrite_value

Keywords CVE-2026-42945NGINX heap buffer overflowngx_http_rewrite_module PCRENGINX rewrite directive overflowNginx-RiftDepthFirstDisclosuresNGINX PCRE capture heap overflowNGINX worker process crash RCENGINX rewrite if set directive overflowK000161019

Versions: All versions not yet End of Technical Support (EoTS) at time of disclosure

Ranked PoCs (44) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

DepthFirstDisclosures/Nginx-Rift candidate

cited in references · recent activity

gh_search · Python

★ 873
rheodev/CVE-2026-42945 candidate

containerized · recent activity

gh_search · Python

★ 19
dinosn/cve-2026-42945-nginx32-lab candidate

containerized · recent activity

gh_search · Python

★ 1
josephfelix/CVE-2026-42945-nginx-rift candidate

containerized · recent activity

gh_search · Jupyter Notebook

★ 1
hulina9900-boop/DIY-CVE-2026-42945-POC candidate

containerized · recent activity

nomi_sec

★ 0
yusufdalbudak/CVE-2026-42945 candidate

containerized · recent activity

gh_search · Shell

★ 0
MateusVerass/nGixshell needs review

recent activity

gh_search · Python

★ 16
p3Nt3st3r-sTAr/CVE-2026-42945-POC needs review

recent activity

gh_search · Python

★ 15
jelasin/CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 4
tal7aouy/nginx-cve-2026-42945 needs review

recent activity

gh_search · Python

★ 3
0xBlackash/CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 2
F2u0a0d3/CVE-2026-42945-nginx-rift-poc needs review

recent activity

gh_search · Python

★ 1
RedCrazyGhost/CVE-2026-42945 needs review

recent activity

gh_search · Go

★ 1
edgecases-PurpleHax/cve-images needs review

recent activity

gh_search · Dockerfile

★ 1
forxiucn/nginx-cve-2026-42945-poc needs review

recent activity

gh_search · C

★ 1
hnytgl/CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 1
realityone/cve-2026-42945-scan needs review

recent activity

gh_search · Go

★ 1
simota/nginx-rift-scanner needs review

recent activity

gh_search · Python

★ 1
BarAppTeam/nginx-cve-fix needs review

recent activity

nomi_sec

★ 0
ChamsBouzaiene/ai-vuln-rediscovery-nginx-cve-2026-42945 needs review

recent activity

nomi_sec

★ 0
LiaoZiqi-GZFLS/CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 0
imSre9/CVE-2026-42945 needs review

recent activity

nomi_sec

★ 0
limo57640-crypto/nginx-rift-detector needs review

recent activity

nomi_sec

★ 0
quantumworld-dpdns-io/CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 0
soksofos/wazuh-nginx-cve-2026-42945-sca-lab needs review

recent activity

nomi_sec

★ 0
cipherspy/CVE-2026-42945-POC needs review

recent activity

gh_search · Python

★ 45
friparia/NGINX_RIFT_SCAN_CVE_2026_42945 needs review

recent activity

gh_search · Python

★ 32
oseasfr/Scanner_CVE_2026-42945 needs review

recent activity

gh_search · Python

★ 18
nu0l/NGINX-Rift needs review

recent activity

gh_search · Go

★ 5
gagaltotal/CVE-2026-42945-NGINX-Rift-Toolkit needs review

recent activity

gh_search · Python

★ 3
iammerrida-source/nginx-rift-detect needs review

recent activity

gh_search · Python

★ 3
strivepan/Nginx_cve-2026-42945-scanner-gui needs review

recent activity

gh_search

★ 3
nanwinata/nginxrift-CVE-2026-42945 needs review

recent activity

gh_search · Python

★ 2
Renison-Gohel/CVE-2026-42945-NGINX-Rift needs review

recent activity

gh_search · Python

★ 1
chenqin231/CVE-2026-42945 needs review

recent activity

gh_search · Shell

★ 1
aratane/CVE-2026-42945 needs review

recent activity

nomi_sec

★ 0
azilRababe/CVE-2026-42945 needs review

recent activity

gh_search

★ 0
byezero/nginx-cve-2026-42945-check needs review

recent activity

nomi_sec

★ 0
fkj-src/fix_nginx_cve_2026_42945 needs review

recent activity

nomi_sec

★ 0
jenniferreire26/CVE-2026-42945 needs review

recent activity

nomi_sec

★ 0
lowilol/CVE-2026-42945-NGINX-Rift-Check-Script needs review

recent activity

nomi_sec

★ 0
sec-sys/CVE-2026-42945-Reverse-Shell-POC needs review

recent activity

nomi_sec

★ 0
sibersan/web-server-audit_CVE-2026-42945 needs review

recent activity

nomi_sec

★ 0
webdev75950-ux/nginx-rce-cve-2026-42945 needs review

recent activity

nomi_sec

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

Bitnami	nginx	0.6.27 → 1.30.1
Bitnami	nginx-gateway	0.6.27 → 1.30.1

References

Status: enriched · ingested 2026-06-27T06:00:38.000Z · profiled 2026-07-01T12:30:14.000Z