Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42945 |
| Alert Source | F5 Security Advisory (K000160932) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | F5 (NGINX) |
| Product | NGINX (ngx_http_rewrite_module) |
| Vulnerability Type | Remote Code Execution (Heap Buffer Overflow) |
| CVSS Score | 9.2 (critical) |
| Public PoC | YES — available on GitHub |
| CISA KEV | Not yet |
| Ransomware | Not confirmed |
Vulnerability Description
Source: F5 Security Advisory
A critical vulnerability in NGINX’s
ngx_http_rewrite_moduleallows an unauthenticated remote attacker to execute arbitrary code on vulnerable systems. The issue is caused by a heap buffer overflow triggered by improper handling ofrewriteandsetdirectives in NGINX configuration. Specially crafted HTTP requests can lead to remote code execution in the context of the NGINX worker process.
According to researchers, the vulnerability has existed in the NGINX source code since 2008 and impacts a broad range of NGINX- and F5-based products. A working Proof-of-Concept (PoC) exploit has been publicly released on GitHub, significantly increasing the risk of mass exploitation in the coming days.
The same F5 advisory also covers 3 additional memory corruption vulnerabilities (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934).
Required Actions
Highest update priority — the public PoC means real risk of mass exploitation.
Update vulnerable NGINX/F5 products to vendor-fixed releases:
- NGINX Open Source (0.6.27 — 1.30.0) — upgrade to the latest patched release
- NGINX Plus (R32 — R36) — upgrade per F5 advisory
- NGINX Instance Manager (2.16.0 — 2.21.1)
- F5 WAF for NGINX (5.9.0 — 5.12.1)
- NGINX App Protect WAF (4.9.0 — 4.16.0 and 5.1.0 — 5.8.0)
- F5 DoS for NGINX (4.8.0)
- NGINX App Protect DoS (4.3.0 — 4.7.0)
- NGINX Gateway Fabric (1.3.0 — 1.6.2 and 2.0.0 — 2.5.1)
- NGINX Ingress Controller (3.5.0 — 3.7.2, 4.0.0 — 4.0.1, 5.0.0 — 5.4.1)
Workarounds for systems that cannot be patched immediately:
- Review NGINX configurations for combined use of
rewriteandsetdirectives (the primary attack vector) — temporarily disable complex rewrite rules where feasible. - Place vulnerable systems behind an additional WAF protection layer (e.g., AWS WAF, Cloudflare, Imperva) with malicious HTTP payload inspection rules enabled.
- Deploy IDS/IPS signatures that detect attempts to exploit the known PoC.
- Monitor NGINX logs and worker processes for unusual crashes (a typical indicator of buffer overflow exploitation attempts).
Who Is Affected?
This vulnerability affects a massive portion of the internet infrastructure — NGINX currently serves roughly one-third of the world’s websites. Practically every organization should assess exposure:
- Production web servers — NGINX Open Source and NGINX Plus as reverse proxy, load balancer, edge gateway
- Containers and Kubernetes — NGINX Ingress Controller is the default ingress in many K8s clusters
- API Gateway — NGINX as a frontend for microservices
- WAF and application protection — F5 WAF for NGINX, NGINX App Protect (ironically: the WAF itself is vulnerable)
- Edge / CDN — NGINX often serves as the first line of traffic reception
Since the vulnerability has existed since 2008 and requires only an HTTP request to an unauthenticated endpoint, automated scanners and botnets can be expected to begin mass exploitation within hours/days of the PoC’s release.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
