## Overview

NGINX Rift, tracked as CVE-2026-42945, is a heap-based buffer overflow (CWE-122) in NGINX's ngx_http_rewrite_module discovered and disclosed by autonomous vulnerability discovery system DepthFirst on 2026-05-13. F5 Networks, the CNA for NGINX, assigned a CVSS v4.0 base score of 9.2 (Critical) and a CVSS v3.1 score of 8.1 (High), reflecting unauthenticated network exploitation with high impact on confidentiality, integrity, and availability. The flaw exists in code dating back to NGINX 0.6.27 (2009), making it an 18-year-old vulnerability in the world's most widely deployed reverse proxy and web server — NGINX powers an estimated 33% of the public web by request volume.

## Affected Code Path and Trigger

The vulnerable logic lives in ngx_http_rewrite_module.c's handling of regex captures during rewrite, if, and set directive evaluation. When a rewrite directive uses an unnamed PCRE capture group reference ($1, $2, $3, ...) and the replacement string contains a literal question mark, NGINX's variable-substitution code path miscalculates the destination buffer size for the rewritten URI. A second rewrite, if, or set directive in the same location/server scope that operates on the rewritten value then triggers an out-of-bounds write into the worker heap. The buffer underprovision is deterministic, and the overflow primitive overwrites adjacent heap chunk metadata and pool-allocator structures, allowing controlled corruption of NGINX's ngx_pool_t arena.

The trigger configuration idiom is common in production:

``` location / { rewrite ^/old/(.*)$ /new/$1?legacy=true; # unnamed capture + '?' in replacement if ($http_user_agent ~* bot) { # second directive operating on URI return 403; } } ```

Any request to the affected location with a URL that matches the rewrite pattern triggers the overflow. No authentication, no user interaction, and no special headers are required — the entire exploitation primitive is reachable from an anonymous HTTP request.

## Exploit Chain

1. **Reconnaissance** — Attacker identifies NGINX targets via Shodan, Censys, or banner fingerprinting (Server header). The Rift PoC includes a passive fingerprint that estimates the configuration shape using probe requests against /robots.txt, /favicon.ico, and common rewrite-target paths to detect rewrite chains. 2. **Configuration Probing** — DepthFirst's writeup documents a heuristic prober that sends requests with sentinel patterns (e.g., /old/AAAA?test=BBBB) to detect rewrite-chain behavior in the HTTP response (302 Location header, internal redirect chain length, response timing). 3. **Heap Spray and Layout** — The exploit primes the NGINX pool allocator by issuing 100–500 large requests with controlled header values to populate adjacent heap chunks with attacker-controlled data. Pool fragmentation creates predictable layout for the overflow target. 4. **Trigger Request** — The attacker sends the malformed request that triggers the rewrite overflow. The overflow corrupts an adjacent pool_cleanup_t struct's cleanup handler pointer, which NGINX dereferences on connection teardown. 5. **Control Hijack (ASLR disabled)** — When ASLR is disabled at the OS or binary level (common on stripped containers, embedded appliances, and statically-linked NGINX builds), the attacker overwrites the cleanup handler with a known address pointing to a ROP gadget or a system() call. NGINX's master process retains setuid root capability for binding low ports, but workers drop to nobody; RCE executes as the worker user (commonly nginx, www-data, or nobody). 6. **Denial of Service (ASLR enabled)** — When ASLR is enabled, the dereferenced pointer is unpredictable and the worker SIGSEGVs. NGINX master respawns the worker, but a sustained exploit campaign exhausts the worker_processes pool and creates a denial-of-service condition.

## Why the 18-Year Lifespan

The overflow has existed since NGINX 0.6.27 (released October 2009) because the buffer-size calculation for PCRE replacements predates the inclusion of '?' as a special URI delimiter in the rewrite pipeline. The bug was not caught by AddressSanitizer or libFuzzer runs because the trigger requires a specific multi-directive configuration that public fuzzing harnesses did not generate. DepthFirst's autonomous discovery system used grammar-guided configuration synthesis combined with constraint-solving over PCRE replacement strings to find the trigger pattern.

## Public PoC and Weaponization Status

A public PoC named Nginx-Rift was published to https://github.com/DepthFirstDisclosures/Nginx-Rift on 2026-05-13 (same day as disclosure) and as of 2026-05-14 has 433 stars and 77 forks. The repository contains:

- A Python exploit (rift.py) that probes for the vulnerability and delivers the DoS payload - A Docker test harness with vulnerable NGINX 1.30.0 configured with a triggering rewrite chain - A configuration auditor that scans nginx.conf files for vulnerable patterns - A constraint-solving module that generates working PCRE captures plus replacement strings tailored to a target's URL space

The RCE primitive (cleanup-handler hijack) is documented in the DepthFirst writeup but is not weaponized in the public PoC; only the DoS path is provided.

## Affected NGINX Family Products

F5 confirmed the vulnerable code path is shared across the entire NGINX product family: NGINX Open Source 0.6.27 through 1.30.0; NGINX Plus R32 through R36; NGINX Instance Manager 2.16.0 through 2.21.1; F5 WAF for NGINX 5.9.0 through 5.12.1; NGINX App Protect WAF 4.9.0 through 4.16.0 and 5.1.0 through 5.8.0; F5 DoS for NGINX 4.8.0; NGINX App Protect DoS 4.3.0 through 4.7.0; NGINX Gateway Fabric 1.3.0 through 1.6.2 and 2.0.0 through 2.5.1; NGINX Ingress Controller 3.5.0 through 3.7.2, 4.0.0 through 4.0.1, and 5.0.0 through 5.4.1. Products on F5's distributed cloud platforms (F5 Distributed Cloud, F5 Silverline, NGINX One Console) and the BIG-IP/BIG-IQ/F5OS line are not affected — they share TMOS code and do not link the vulnerable ngx_http_rewrite_module.

## Companion CVEs in the Advisory

F5 disclosed two additional medium-severity issues alongside CVE-2026-42945. CVE-2026-42946 is a buffer overread in ngx_http_scgi_module and ngx_http_uwsgi_module that leaks up to 64 bytes of adjacent worker memory through SCGI/uWSGI upstream responses; this affects information disclosure but not memory corruption. CVE-2026-40701 is a use-after-free in the ngx_resolver during OCSP stapling response handling that requires a malicious upstream DNS server to trigger. Both are fixed in the same 1.31.0 and 1.30.1 releases.

## Detection and Response

Defenders should:

- Upgrade to NGINX 1.31.0 (mainline), 1.30.1 (stable), NGINX Plus R36 P4, or NGINX Plus R32 P6 immediately - Audit nginx.conf for the trigger pattern: rewrite/if/set directives that share scope with another rewrite using $N captures and a question mark in the replacement - Enable ASLR on all NGINX hosts (cat /proc/sys/kernel/randomza_va_space should be 2) - Deploy WAF rules that block requests where the URI matches a configured rewrite pattern and contains overly long capture-targetable substrings - Monitor for repeated worker_process crashes via systemd-journald, nginx error log SIGSEGV entries, and Prometheus node_exporter process_resident_memory_bytes anomalies