Critical NGINX Vulnerabilities Disclosed, Including 18‑Year‑Old Heap Buffer Overflow

Security researchers have uncovered multiple vulnerabilities affecting both NGINX Plus and NGINX Open, with one critical flaw remaining undetected for 18 years. CVE‑2026‑42945 is a heap buffer overflow in the ngx_http_rewrite_module that can lead to remote code execution or a denial‑of‑service crash. The flaw carries a CVSS v4 score of 9.2, indicating a high‑severity risk. The vulnerability affects both commercial and open‑source versions of NGINX, exposing a wide range of web servers to potential exploitation. Researchers recommend that all users upgrade to the latest patched release immediately. In addition to the heap overflow, other unspecified vulnerabilities were identified, but the rewrite module flaw is the most critical. The NGINX team has released a patch that addresses the buffer overflow and related issues. Administrators should verify that the module is updated and that no legacy configurations remain vulnerable.