CVE Feed

    Dashboard / CVE / CVE-2026-42945

    CVE-2026-42945

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published:May 13, 2026
    Last Modified:Aug 25, 2026
    EPS:May 13, 2026
    EPSS Score:0.68047
    CVSS Score:8.1

    Affected Products

    Vendor
    F5
    Product
    Dos
    Vendor
    F5
    Product
    Nginx Gateway Fabric
    Vendor
    F5
    Product
    Nginx Ingress Controller
    Vendor
    F5
    Product
    Nginx Instance Manager
    Vendor
    F5
    Product
    Nginx Open Source
    Vendor
    F5
    Product
    Nginx Plus
    Vendor
    F5
    Product
    Waf

    Exploits

    https://github.com/DepthFirstDisclosures/Nginx-Rifthttps://github.com/0xBlackash/CVE-2026-42945https://github.com/aratane/CVE-2026-42945https://github.com/azilRababe/CVE-2026-42945https://github.com/BarAppTeam/nginx-cve-fixhttps://github.com/byezero/nginx-cve-2026-42945-checkhttps://github.com/ChamsBouzaiene/ai-vuln-rediscovery-nginx-cve-2026-42945https://github.com/chenqin231/CVE-2026-42945https://github.com/cipherspy/CVE-2026-42945-POChttps://github.com/CynepMyx/nginx-rift-checkhttps://github.com/dinosn/cve-2026-42945-nginx32-labhttps://github.com/F2u0a0d3/CVE-2026-42945-nginx-rift-pochttps://github.com/fkj-src/fix_nginx_cve_2026_42945https://github.com/forxiucn/nginx-cve-2026-42945-pochttps://github.com/FranklinF25/cve-2026-42945https://github.com/friparia/NGINX_RIFT_SCAN_CVE_2026_42945https://github.com/gagaltotal/CVE-2026-42945-NGINX-Rift-Toolkithttps://github.com/hnytgl/CVE-2026-42945https://github.com/hulina9900-boop/DIY-CVE-2026-42945-POChttps://github.com/iammerrida-source/nginx-rift-detecthttps://github.com/imSre9/CVE-2026-42945https://github.com/jelasin/CVE-2026-42945https://github.com/josephfelix/CVE-2026-42945-nginx-rifthttps://github.com/Kentox493/CVE-2026-42945_NginxRifthttps://github.com/LiaoZiqi-GZFLS/CVE-2026-42945https://github.com/limo57640-crypto/nginx-rift-detectorhttps://github.com/lowilol/CVE-2026-42945-NGINX-Rift-Check-Scripthttps://github.com/MateusVerass/nGixshellhttps://github.com/nanwinata/nginxrift-CVE-2026-42945https://github.com/nu0l/NGINX-Rifthttps://github.com/oseasfr/Scanner_CVE_2026-42945https://github.com/p3Nt3st3r-sTAr/CVE-2026-42945-POChttps://github.com/quantumworld-dpdns-io/CVE-2026-42945https://github.com/realityone/cve-2026-42945-scanhttps://github.com/RedCrazyGhost/CVE-2026-42945https://github.com/Renison-Gohel/CVE-2026-42945-NGINX-Rifthttps://github.com/rheodev/CVE-2026-42945https://github.com/sec-sys/CVE-2026-42945-Reverse-Shell-POChttps://github.com/sibersan/web-server-audit_CVE-2026-42945https://github.com/simota/nginx-rift-scannerhttps://github.com/soksofos/wazuh-nginx-cve-2026-42945-sca-labhttps://github.com/strivepan/Nginx_cve-2026-42945-scanner-guihttps://github.com/tal7aouy/nginx-cve-2026-42945https://github.com/webdev75950-ux/nginx-rce-cve-2026-42945https://github.com/yusufdalbudak/CVE-2026-42945

    References

    https://my.f5.com/manage/s/article/K000161019
    https://depthfirst.com/nginx-rift
    https://github.com/DepthFirstDisclosures/Nginx-Rift
    https://access.redhat.com/errata/RHSA-2026:17417
    https://access.redhat.com/errata/RHSA-2026:17751
    https://access.redhat.com/errata/RHSA-2026:17752
    https://access.redhat.com/errata/RHSA-2026:17753
    https://access.redhat.com/errata/RHSA-2026:17790
    https://access.redhat.com/errata/RHSA-2026:17791
    https://access.redhat.com/errata/RHSA-2026:17792
    https://access.redhat.com/errata/RHSA-2026:17793
    https://access.redhat.com/errata/RHSA-2026:17794
    https://access.redhat.com/errata/RHSA-2026:18029
    https://access.redhat.com/errata/RHSA-2026:18041
    https://access.redhat.com/errata/RHSA-2026:18063
    https://access.redhat.com/errata/RHSA-2026:19159
    https://access.redhat.com/errata/RHSA-2026:19371
    https://access.redhat.com/errata/RHSA-2026:19372
    https://access.redhat.com/errata/RHSA-2026:19374
    https://access.redhat.com/errata/RHSA-2026:20442
    https://access.redhat.com/errata/RHSA-2026:20444
    https://access.redhat.com/errata/RHSA-2026:21275
    https://access.redhat.com/errata/RHSA-2026:22382
    https://access.redhat.com/errata/RHSA-2026:22383
    https://access.redhat.com/errata/RHSA-2026:22388
    https://access.redhat.com/errata/RHSA-2026:22389
    https://access.redhat.com/errata/RHSA-2026:22390
    https://access.redhat.com/errata/RHSA-2026:22393
    https://access.redhat.com/errata/RHSA-2026:22394
    https://access.redhat.com/errata/RHSA-2026:22396
    https://access.redhat.com/errata/RHSA-2026:58981
    https://access.redhat.com/security/cve/CVE-2026-42945
    https://bugzilla.redhat.com/show_bug.cgi?id=2477116
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High