CVE-2026-42945

Name of the Vulnerable Software and Affected Versions NGINX Plus and NGINX Open Source versions 0.6.27 through 1.30.0

Description A heap buffer overflow exists in the ngx http rewrite module module. The issue occurs when a rewrite directive is followed by a rewrite, if, or set directive and utilizes an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g., $1, $2) with a replacement string containing a question mark (?). This is caused by inconsistent state management where an is args flag remains enabled during the data copy pass, leading the server to write escaped values that exceed the allocated buffer size.

An unauthenticated remote attacker can exploit this by sending crafted HTTP requests. This typically results in a denial of service due to the NGINX worker process restarting. However, if Address Space Layout Randomization (ASLR), a security technique used to prevent exploitation by randomizing memory addresses, is disabled or bypassed, arbitrary code execution is possible. Approximately 18.9 million internet-facing instances were estimated to be exposed, and real-world exploitation has been observed.

Recommendations Update NGINX Open Source to version 1.30.1 or 1.31.0. Update NGINX Plus to version R32 P6 or R36 P4. As a temporary mitigation, replace all unnamed PCRE captures with named captures in the affected directives.