CVE-2026-42945

Name of the Vulnerable Software and Affected Versions NGINX Plus and NGINX Open Source versions 0.6.27 through 1.30.0

Description A heap buffer overflow exists in the ngx http rewrite module module. The issue occurs when a rewrite directive is followed by a rewrite, if, or set directive and utilizes an unnamed Perl-Compatible Regular Expression (PCRE) capture (such as $1 or $2) with a replacement string containing a question mark (?). This is caused by inconsistent state management where an is args flag remains enabled during the data copy pass, leading the server to write escaped values that exceed the allocated buffer size.

An unauthenticated remote attacker can exploit this by sending crafted HTTP requests. This typically results in a denial of service due to the NGINX worker process crashing and restarting. However, remote code execution is possible on systems where Address Space Layout Randomization (ASLR), a security technique used to prevent exploitation by randomizing memory addresses, is disabled or bypassed. Approximately 18.9 million internet-facing NGINX servers were estimated to be potentially affected, and real-world exploitation has been observed.

Recommendations Update NGINX Open Source to version 1.30.1 or 1.31.0. Update NGINX Plus to version R32 P6 or R36 P4. As a temporary mitigation, replace all unnamed PCRE captures with named captures in the affected rewrite, if, or set directives.