F5 NGINX Plus/NGINX Open Source HTTP ngx_http_rewrite_module heap-based overflow

Summaryinfo

A vulnerability was found in F5 NGINX Plus and NGINX Open Source and classified as critical. This impacts the function ngx_http_rewrite_module of the component HTTP Handler. The manipulation results in heap-based overflow. This vulnerability is known as CVE-2026-42945. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in F5 NGINX Plus and NGINX Open Source (the affected version is unknown). It has been classified as critical. Affected is the function ngx_http_rewrite_module of the component HTTP Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The weakness was published by Zhenpeng as K000161019. The advisory is available at my.f5.com. This vulnerability is traded as CVE-2026-42945 since 05/01/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/30/2026).

The vulnerability scanner Nessus provides a plugin with the ID 315005 (RHEL 9 : nginx (RHSA-2026:17792)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315005) and CERT Bund (WID-SEC-2026-1527). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• NGINX NGINX Plus
• NGINX NGINX
• SUSE Linux

Productinfo

Type

• Web Server

Vendor

• F5

Name

• NGINX Open Source
• NGINX Plus

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion