Unauthenticated attackers can execute remote code via NGINX rewrite module vulnerabilities

Summary

F5 has disclosed a high-severity vulnerability affecting NGINX Plus and NGINX Open Source. The flaw, identified as CVE-2026-42945, resides within the ngx_http_rewrite_module. An unauthenticated attacker can exploit this by sending crafted HTTP requests that trigger a heap buffer overflow in the NGINX worker process.

The impact of this vulnerability ranges from service instability to full system compromise. Depending on the environment, an attacker may cause the worker process to restart or execute arbitrary code on the host system.

Technical details

The vulnerability is triggered when a rewrite directive is followed by a rewrite, if, or set directive that utilizes an unnamed Perl-Compatible Regular Expression (PCRE) capture. Specifically, the issue arises if the replacement string includes a question mark (?).

For example, if a configuration uses captures like $1 or $2 within these directives alongside a question mark in the replacement string, the ngx_http_rewrite_module may fail to handle the memory allocation correctly. This results in a heap buffer overflow.

The severity of the outcome depends on the system's memory protections. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, an attacker can achieve code execution. In other scenarios, the overflow will likely cause the NGINX worker process to crash and restart.

Affected products and fixed versions

The vulnerability affects both NGINX Plus and NGINX Open Source.

Note that software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Why this matters for defenders

This flaw is particularly dangerous because it can be exploited by an unauthenticated attacker via standard HTTP requests. If your NGINX configuration relies on complex rewrite rules involving PCRE captures and question marks, you are at risk of both service disruption and unauthorized code execution.

The ability to bypass ASLR or exploit systems where ASLR is not active makes this a high-priority fix for infrastructure teams managing edge load balancers or web servers.

Defender guidance

Review your NGINX configuration files for any rewrite, if, or set directives that use unnamed PCRE captures (such as $1, $2) in conjunction with a question mark (?) in the replacement string.

If such patterns are found, update your NGINX installation to a patched version provided by F5. Because this is a module-level vulnerability in the ngx_http_rewrite_module, ensuring your binaries are up to date is the primary defense.