NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical, 18-Year-Old Pre-Auth RCE, Public PoC) — Threadlinqs Intelligence
As of 2026-05-30, NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical, 18-Year-Old Pre-Auth RCE, Public PoC) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0517 · Severity: CRITICAL · CVSS: 9.2 · Status: ACTIVE · Category: VULNERABILITY
NGINX Rift (CVE-2026-42945) is an unauthenticated heap-based buffer overflow in the ngx_http_rewrite_module that affects NGINX Open Source 0.6.27 through 1.30.0 and NGINX Plus R32 through R36,
## Overview
NGINX Rift, tracked as CVE-2026-42945, is a heap-based buffer overflow (CWE-122) in NGINX's ngx_http_rewrite_module discovered and disclosed by autonomous vulnerability discovery system DepthFirst on 2026-05-13. F5 Networks, the CNA for NGINX, assigned a CVSS v4.0 base score of 9.2 (Critical) and a CVSS v3.1 score of 8.1 (High), reflecting unauthenticated network exploitation with high impact on confidentiality, integrity, and availability. The flaw exists in code dating back to NGINX 0.6.27 (2009), making it an 18-year-old vulnerability in the world's most widely deployed reverse proxy and web server — NGINX powers an estimated 33% of the public web by request volume.
## Affected Code Path and Trigger
The vulnerable logic lives in ngx_http_rewrite_module.c's handling of regex captures during rewrite, if, and set directive evaluation. When a rewrite directive uses an unnamed PCRE capture group reference ($1, $2, $3, ...) and the replacement string contains a literal question mark, NGINX's variable-substitution code path miscalculates the destination buffer size for the rewritten URI. A second rewrite, if, or set directive in the same location/server scope that operates on the rewritten value then triggers an out-of-bounds write into the worker heap. The buffer underprovision is deterministic, and the overflow primitive overwrites adjacent heap chunk metadata and pool-allocator structures, allowing controlled corruption of NGINX's ngx_pool_t arena.
The trigger configuration idiom is common in production:
```
location / {
rewrite ^/old/(.*)$ /new/$1?legacy=true; # unnamed capture + '?' in replacement
if ($http_user_agent ~* bot) { # second directive operating on URI
return 403;
}
}
```
Any request to the affected location with a URL that matches the rewrite pattern triggers the overflow. No authentication, no user interaction, and no special headers are required — the entire exploitation primitive is reachable from an anonymous HTTP request.
## Exploit Chain
1. **Reconnaissance** — Attacker identifies NGINX targets via Shodan, Censys, or banner fingerprinting (Server header). The Rift PoC includes a passive fingerprint that estimates the configuration shape using probe requests against /robots.txt, /favicon.ico, and common rewrite-target paths to detect rewrite chains.
2. **Configuration Probing** — DepthFirst's writeup documents a heuristic prober that sends requests with sentinel patterns (e.g., /old/AAAA?test=BBBB) to detect rewrite-chain behavior in the HTTP response (302 Location header, internal redirect chain length, response timing).
3. **Heap Spray and Layout** — The exploit primes the NGINX pool allocator by issuing 100–500 large requests with controlled header values to populate adjacent heap chunks with attacker-controlled data. Pool fragmentation creates predictable layout for the overflow target.
4. **Trigger Request** — The attacker sends the malformed request that triggers the rewrite overflow. The overflow corrupts an adjacent pool_cleanup_t struct's cleanup handler pointer, which NGINX dereferences on connection teardown.
5. **Control Hijack (ASLR disabled)** — When ASLR is disabled at the OS or binary level (common on stripped containers, embedded appliances, and statically-linked NGINX builds), the attacker overwrites the cleanup handler with a known address pointing to a ROP gadget or a system() call. NGINX's master process retains setuid root capability for binding low ports, but workers drop to nobody; RCE executes as the worker user (commonly nginx, www-data, or nobody).
6. **Denial of Service (ASLR enabled)** — When ASLR is enabled, the dereferenced pointer is unpredictable and the worker SIGSEGVs. NGINX master respawns the worker, but a sustained exploit campaign exhausts the worker_processes pool and creates a denial-of-service condition.
## Why the 18-Year Lifespan
The overflow has existed since NGINX 0.6.27 (released October 2009) because the b
Weaknesses (CWE)
CWE-122, CWE-787, CWE-126, CWE-416
Target sectors: government, financial, healthcare, technology, telecommunications, ecommerce, media, education, cloud, managed-services, critical-infrastructure
Target regions: Global, North America, Europe, Asia-Pacific, Latin America, Middle East, Africa
Detections & IOCs
As of 2026-07-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-42945, CVE-2026-42946, CVE-2026-40701, T1595, T1595.002, T1592.002, T1596.005, T1588.005, T1588.006, T1587.004, T1190, T1133, T1059.004