F5 NGINX Plus vulnerability
F5NGINX Plus
- Not in CISA KEV
- Vendor fix available
Higher than 89% of scored CVEs
Description NVD
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Coverage 7 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 14 May · 06:50 UTC | The Hacker News | NGINX Rift Bug Lets Attackers Run Code Remotely via Malicious URI |
| Thu 14 May · 12:31 UTC | SOCRadar | CVE-2026-42945: NGINX Rewrite Bug Allows Remote Code Execution |
| Thu 14 May · 14:30 UTC | Security Affairs | NGINX Rift flaw lets attackers run code with one HTTP request |
| Sat 16 May · 10:31 UTC | SecurityWeek | PoC Code Published for Critical NGINX Vulnerability |
| Sun 17 May · 15:01 UTC | The Hacker News | CVE-2026-42945 Exploit Seen In Wild, NGINX Users Urged To Patch |
| Mon 18 May · 07:21 UTC | Security Affairs | NGINX Rift flaw CVE-2026-42945 exploited despite ASLR mitigations |
| Mon 18 May · 08:01 UTC | SecurityWeek | Hackers Exploit NGINX Zero Day CVE-2026-42945 in Wild |
- Hackers Exploit NGINX Zero Day CVE-2026-42945 in WildSecurityWeek
- NGINX Rift flaw CVE-2026-42945 exploited despite ASLR mitigationsSecurity Affairs
- CVE-2026-42945 Exploit Seen In Wild, NGINX Users Urged To PatchThe Hacker News
- PoC Code Published for Critical NGINX VulnerabilitySecurityWeek
- NGINX Rift flaw lets attackers run code with one HTTP requestSecurity Affairs
- CVE-2026-42945: NGINX Rewrite Bug Allows Remote Code ExecutionSOCRadar
- NGINX Rift Bug Lets Attackers Run Code Remotely via Malicious URIThe Hacker News · first in our coverage