CVE-2026-42945: Heap buffer overflow in NGINX rewrite module

CVE-2026-42945 is a heap buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source. The flaw manifests when the rewrite directive is followed by rewrite, if, or set with unnamed PCRE capture group ($1, $2) and question mark (?) in the replacement string. An unauthenticated attacker can exploit it by sending crafted HTTP requests, causing the NGINX worker process to restart and, on systems without ASLR, potentially executing arbitrary code.

The vulnerability has CVSS 8.1 (high severity) and was published on May 13, 2026. There are no reports of active exploitation. A GitHub signal dated October 29, 2026 shows educational material on the flaw. The specific configuration required (rewrite with unnamed PCRE capture and question mark in the replacement) limits exposed environments, but NGINX is widely deployed in critical infrastructure, making the potential impact significant.

To mitigate this vulnerability, verify the NGINX versions in use and apply security patches as soon as they become available. Review rewrite configurations in nginx.conf to identify the matching pattern: rewrite followed by rewrite/if/set with unnamed PCRE capture groups ($1, $2, etc.) and question mark in the replacement. If patching is not immediately possible, disable non-essential rewrite modules and restrict access to vulnerable configurations using firewall or WAF policies. Monitor NGINX worker logs for signs of unexpected crashes.