NGINX Vulnerability CVE-2026-42945: Heap Buffer Overflow in Rewrite Module Exploited in Wild

A new heap buffer overflow vulnerability, CVE-2026-42945, has been disclosed in the ngx_http_rewrite_module of NGINX. The flaw is rated CVSS 9.2 and affects all NGINX releases from 0.6.27 up to 1.30.0, including both NGINX Plus and the open‑source edition. The vulnerability allows remote attackers to trigger a buffer overflow by crafting malicious rewrite rules, potentially leading to arbitrary code execution. Security researchers at depthfirst confirmed that the flaw is already being actively exploited in the wild within days of its public disclosure. The exploit targets the rewrite module’s internal memory handling, which can be triggered via HTTP requests containing specially crafted rewrite directives. NGINX developers have issued a patch in the 1.30.1 release, which includes bounds checking for rewrite rule parsing.

The patch also removes the deprecated rewrite syntax that was previously vulnerable and adds a defensive guard against malformed rewrite directives. Users running older NGINX versions must upgrade immediately to avoid exploitation. The CVE was assigned on 2026‑05‑01 and the advisory was published the following day. NGINX’s official security page now lists the fix and recommends a version upgrade for all affected deployments.