Critical NGINX Vulnerability Exploited via Publicly Released PoC Code

Post Views: 1

Critical NGINX Vulnerability Patched with PoC Code Released

F5 has addressed a critical-severity vulnerability, tracked as CVE-2026-42945 (CVSS score of 9.2), in its widely-used web server.

The issue, described as a heap buffer overflow in the ngx_http_rewrite_module component, can be exploited to trigger a restart, causing a denial-of-service (DoS) condition.
In addition to DoS, remote code execution (RCE) is possible if Address Space Layout Randomization (ASLR) is disabled.

The vulnerability affects NGINX servers utilizing rewrite and set directives. According to F5, the flaw stems from the use of a two-pass process in the script engine.

“The issue arises when a rewrite replacement containing a question mark (‘?’) is employed, an unpropagated flag leads to an undersized buffer allocation, allowing attacker-controlled escaped URI data to be written past the heap boundary.”

To exploit this vulnerability, an attacker would need to pad the request URI with plus signs, forcing the escaping function to expand each byte into three bytes, thereby overflowing the allocated chunk. Since null bytes cannot be used for the overflow, achieving RCE requires overwriting all fields in the NGINX memory pool until the target pointer, followed by destroying the pool as soon as the pool header corruption occurs without crashing the worker process.

F5 patched the vulnerability in NGINX Plus versions 37.0.0, R36 P4, and R32 P6, as well as in NGINX open-source versions 1.31.0 and 1.30.1. Users are advised to update their installations to the latest version to prevent potential exploitation.