Multiple Vulnerabilities in NGINX Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in NGINX, the most severe of which could allow for remote code execution. NGINX is a software used for web serving, reverse proxying, caching, and load balancing. Successful exploitation of the most severe of these vulnerabilities may allow an unauthenticated threat actor to crash vulnerable NGINX worker processes by sending crafted HTTP requests. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, exploitation may result in remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.

A proof-of concept exploit has been published by DepthFirst. In addition, an individual at VulnCheck has reported that CVE-2026-42945 has been exploited in the wild.

Multiple vulnerabilities have been discovered in NGINX, the most severe of which could allow for remote code execution. Details of the vulnerabilities are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of the most severe of these vulnerabilities may allow an unauthenticated threat actor to crash vulnerable NGINX worker processes by sending crafted HTTP requests. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, exploitation may result in remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®