# NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical, 18-Year-Old Pre-Auth RCE, Public PoC)

> NGINX Rift (CVE-2026-42945) is an unauthenticated heap-based buffer overflow in the ngx_http_rewrite_module that affects NGINX Open Source 0.6.27 through 1.30.0 and NGINX Plus R32 through R36, disclosed by autonomous vulnerability researcher DepthFirst on 2026-05-13. A specific configuration idiom — a rewrite directive followed by a rewrite, if, or set directive in the same scope, combined with an unnamed PCRE capture ($1, $2, ...) whose replacement string contains a question mark — allows a crafted HTTP request to corrupt the heap of an NGINX worker process. The deterministic outcome is a worker crash and denial of service; on hosts with ASLR disabled (embedded appliances, legacy containers, statically-linked builds) the primary is remote code execution. F5 issued fixes in 1.31.0, 1.30.1, NGINX Plus R36 P4 and R32 P6 the same day as disclosure, and a public weaponizable PoC is hosted at DepthFirstDisclosures/Nginx-Rift on GitHub.

- **Published:** 2026-05-14T12:00:00Z
- **Last reviewed:** 2026-05-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0517
- **ID:** TL-2026-0517
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42945, CVE-2026-42946, CVE-2026-40701

## Description

## Overview

NGINX Rift, tracked as CVE-2026-42945, is a heap-based buffer overflow (CWE-122) in NGINX's ngx_http_rewrite_module discovered and disclosed by autonomous vulnerability discovery system DepthFirst on 2026-05-13. F5 Networks, the CNA for NGINX, assigned a CVSS v4.0 base score of 9.2 (Critical) and a CVSS v3.1 score of 8.1 (High), reflecting unauthenticated network exploitation with high impact on confidentiality, integrity, and availability. The flaw exists in code dating back to NGINX 0.6.27 (2009), making it an 18-year-old vulnerability in the world's most widely deployed reverse proxy and web server — NGINX powers an estimated 33% of the public web by request volume.

## Affected Code Path and Trigger

The vulnerable logic lives in ngx_http_rewrite_module.c's handling of regex captures during rewrite, if, and set directive evaluation. When a rewrite directive uses an unnamed PCRE capture group reference ($1, $2, $3, ...) and the replacement string contains a literal question mark, NGINX's variable-substitution code path miscalculates the destination buffer size for the rewritten URI. A second rewrite, if, or set directive in the same location/server scope that operates on the rewritten value then triggers an out-of-bounds write into the worker heap. The buffer underprovision is deterministic, and the overflow primitive overwrites adjacent heap chunk metadata and pool-allocator structures, allowing controlled corruption of NGINX's ngx_pool_t arena.

The trigger configuration idiom is common in production:

```
location / {
    rewrite ^/old/(.*)$ /new/$1?legacy=true;   # unnamed capture + '?' in replacement
    if ($http_user_agent ~* bot) {              # second directive operating on URI
        return 403;
    }
}
```

Any request to the affected location with a URL that matches the rewrite pattern triggers the overflow. No authentication, no user interaction, and no special headers are required — the entire exploitation primitive is reachable from an anonymous HTTP request.

## Exploit Chain

1. **Reconnaissance** — Attacker identifies NGINX targets via Shodan, Censys, or banner fingerprinting (Server header). The Rift PoC includes a passive fingerprint that estimates the configuration shape using probe requests against /robots.txt, /favicon.ico, and common rewrite-target paths to detect rewrite chains.
2. **Configuration Probing** — DepthFirst's writeup documents a heuristic prober that sends requests with sentinel patterns (e.g., /old/AAAA?test=BBBB) to detect rewrite-chain behavior in the HTTP response (302 Location header, internal redirect chain length, response timing).
3. **Heap Spray and Layout** — The exploit primes the NGINX pool allocator by issuing 100–500 large requests with controlled header values to populate adjacent heap chunks with attacker-controlled data. Pool fragmentation creates predictable layout for the overflow target.
4. **Trigger Request** — The attacker sends the malformed request that triggers the rewrite overflow. The overflow corrupts an adjacent pool_cleanup_t struct's cleanup handler pointer, which NGINX dereferences on connection teardown.
5. **Control Hijack (ASLR disabled)** — When ASLR is disabled at the OS or binary level (common on stripped containers, embedded appliances, and statically-linked NGINX builds), the attacker overwrites the cleanup handler with a known address pointing to a ROP gadget or a system() call. NGINX's master process retains setuid root capability for binding low ports, but workers drop to nobody; RCE executes as the worker user (commonly nginx, www-data, or nobody).
6. **Denial of Service (ASLR enabled)** — When ASLR is enabled, the dereferenced pointer is unpredictable and the worker SIGSEGVs. NGINX master respawns the worker, but a sustained exploit campaign exhausts the worker_processes pool and creates a denial-of-service condition.

## Why the 18-Year Lifespan

The overflow has existed since NGINX 0.6.27 (released October 2009) because the buffer-size calculation for PCRE replacements predates the inclusion of '?' as a special URI delimiter in the rewrite pipeline. The bug was not caught by AddressSanitizer or libFuzzer runs because the trigger requires a specific multi-directive configuration that public fuzzing harnesses did not generate. DepthFirst's autonomous discovery system used grammar-guided configuration synthesis combined with constraint-solving over PCRE replacement strings to find the trigger pattern.

## Public PoC and Weaponization Status

A public PoC named Nginx-Rift was published to https://github.com/DepthFirstDisclosures/Nginx-Rift on 2026-05-13 (same day as disclosure) and as of 2026-05-14 has 433 stars and 77 forks. The repository contains:

- A Python exploit (rift.py) that probes for the vulnerability and delivers the DoS payload
- A Docker test harness with vulnerable NGINX 1.30.0 configured with a triggering rewrite chain
- A configuration auditor that scans nginx.conf files for vulnerable patterns
- A constraint-solving module that generates working PCRE captures plus replacement strings tailored to a target's URL space

The RCE primitive (cleanup-handler hijack) is documented in the DepthFirst writeup but is not weaponized in the public PoC; only the DoS path is provided.

## Affected NGINX Family Products

F5 confirmed the vulnerable code path is shared across the entire NGINX product family: NGINX Open Source 0.6.27 through 1.30.0; NGINX Plus R32 through R36; NGINX Instance Manager 2.16.0 through 2.21.1; F5 WAF for NGINX 5.9.0 through 5.12.1; NGINX App Protect WAF 4.9.0 through 4.16.0 and 5.1.0 through 5.8.0; F5 DoS for NGINX 4.8.0; NGINX App Protect DoS 4.3.0 through 4.7.0; NGINX Gateway Fabric 1.3.0 through 1.6.2 and 2.0.0 through 2.5.1; NGINX Ingress Controller 3.5.0 through 3.7.2, 4.0.0 through 4.0.1, and 5.0.0 through 5.4.1. Products on F5's distributed cloud platforms (F5 Distributed Cloud, F5 Silverline, NGINX One Console) and the BIG-IP/BIG-IQ/F5OS line are not affected — they share TMOS code and do not link the vulnerable ngx_http_rewrite_module.

## Companion CVEs in the Advisory

F5 disclosed two additional medium-severity issues alongside CVE-2026-42945. CVE-2026-42946 is a buffer overread in ngx_http_scgi_module and ngx_http_uwsgi_module that leaks up to 64 bytes of adjacent worker memory through SCGI/uWSGI upstream responses; this affects information disclosure but not memory corruption. CVE-2026-40701 is a use-after-free in the ngx_resolver during OCSP stapling response handling that requires a malicious upstream DNS server to trigger. Both are fixed in the same 1.31.0 and 1.30.1 releases.

## Detection and Response

Defenders should:

- Upgrade to NGINX 1.31.0 (mainline), 1.30.1 (stable), NGINX Plus R36 P4, or NGINX Plus R32 P6 immediately
- Audit nginx.conf for the trigger pattern: rewrite/if/set directives that share scope with another rewrite using $N captures and a question mark in the replacement
- Enable ASLR on all NGINX hosts (cat /proc/sys/kernel/randomza_va_space should be 2)
- Deploy WAF rules that block requests where the URI matches a configured rewrite pattern and contains overly long capture-targetable substrings
- Monitor for repeated worker_process crashes via systemd-journald, nginx error log SIGSEGV entries, and Prometheus node_exporter process_resident_memory_bytes anomalies

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1596.005 Search Open Technical Databases: Scan Databases
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1543.002 Create or Modify System Process: Systemd Service
- T1068 Exploitation for Privilege Escalation
- T1070.004 Indicator Removal: File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1057 Process Discovery
- T1046 Network Service Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1499.004 Application or System Exploitation
- T1489 Service Stop
- T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

## Sources

- [nginx.org Security Advisories — CVE-2026-42945 Buffer overflow in ngx_http_rewrite_module](https://nginx.org/en/security_advisories.html)
- [F5 Security Advisory K000161019 — NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945](https://my.f5.com/manage/s/article/K000161019)
- [DepthFirst — NGINX Rift technical writeup (CVE-2026-42945)](https://depthfirst.com/nginx-rift)
- [DepthFirstDisclosures/Nginx-Rift — Public PoC exploit on GitHub](https://github.com/DepthFirstDisclosures/Nginx-Rift)
- [NVD — CVE-2026-42945 Detail (CVSS v4.0 9.2, CVSS v3.1 8.1, CWE-122)](https://nvd.nist.gov/vuln/detail/CVE-2026-42945)
- [NVD — CVE-2026-42946 Buffer overread in ngx_http_scgi_module and ngx_http_uwsgi_module](https://nvd.nist.gov/vuln/detail/CVE-2026-42946)
- [NVD — CVE-2026-40701 Use-after-free in ngx_resolver OCSP stapling](https://nvd.nist.gov/vuln/detail/CVE-2026-40701)
- [NGINX changelog — 1.31.0 release notes](https://nginx.org/en/CHANGES)
- [MITRE ATT&CK — T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE CWE-122 — Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0517