NGINX CVE-2026-42945 shows how rewrite rules enable DoS and RCE

At a glance

What this is: This is an analysis of CVE-2026-42945 in NGINX rewrite handling, where crafted HTTP requests can trigger a heap buffer overflow that leads to denial of service and, in some environments, remote code execution.

Why it matters: It matters because reverse proxies, ingress controllers, and edge application layers often sit on critical traffic paths, so a parser flaw there can become an outage and compromise issue across many downstream identity and application flows.

By the numbers:

• CVE-2026-42945 was disclosed with a CVSS score of 9.2.
• NGINX Open Source versions 1.0.0 through 1.30.0 are affected.

Context

CVE-2026-42945 is a memory corruption flaw in NGINX rewrite handling that can be triggered by a crafted HTTP request. For identity and access teams, the significance is not the parser bug alone but where NGINX sits in the request path: ingress controllers, gateways, and other internet-facing choke points can turn a single flaw into broad service disruption.

The vulnerable surface is the combination of rewrite directives, unnamed regex captures, and replacement strings that contain a question mark. In practice, that means operationally ordinary configuration patterns can become security-critical when exposed to untrusted traffic. The article also notes that no authentication is required, which makes deployment context the main determinant of risk.

That makes this an NHI and platform governance problem as much as an application vulnerability. Workload-facing traffic controls, edge services, and supporting security products inherit the blast radius when the ingress layer fails, so practitioners need to understand where the vulnerable instance is placed and what it protects.

Key questions

Q: What should teams do first when NGINX rewrite rules are exposed to the internet?

A: Patch the exposed instances first, because unauthenticated request handling makes internet-facing NGINX deployments the fastest path to outage. If patching is delayed, remove the vulnerable rewrite pattern by replacing unnamed captures with named captures and then verify which ingress paths still accept untrusted traffic.

Q: Why does an NGINX rewrite flaw create more risk on ingress controllers than on internal servers?

A: Ingress controllers sit on public request paths and often front multiple applications, authentication flows, and APIs. That placement turns a worker crash into broad service disruption, and it can amplify the business impact far beyond the vulnerable host itself.

Q: What are the signs that NGINX rewrite handling is failing in practice?

A: Look for repeated worker crashes, rapid PID cycling, SIGABRT terminations, and health checks that start failing after crafted requests. Those symptoms indicate that the vulnerable rewrite path is already being exercised and that availability controls are not containing the fault.

Q: What happens when Ingress NGINX vulnerabilities are exploited before teams patch?

A: If exploitation succeeds before remediation, attackers can use the controller weaknesses to reach cluster secrets and potentially take over the environment. The article also notes there are no public proof-of-concept exploits or indicators of compromise yet, so defenders may need to rely on configuration review, network visibility, and post-access behaviour to detect abuse.

Technical breakdown

How the rewrite module turns request parsing into memory corruption

The ngx_http_rewrite_module processes rewrite directives during request handling, including pattern captures and replacement logic. In this case, unnamed PCRE captures combined with a replacement string containing a question mark can create a state mismatch in the script engine. That mismatch leads to a heap buffer overflow in the worker process, which means attacker-controlled input can corrupt memory before the request is fully handled. Because the flaw occurs in a high-frequency request path, repeated exploitation can crash workers reliably and degrade the entire service layer.

Practical implication: Patch the rewrite path first where NGINX is internet-facing and actively handling untrusted traffic.

Why ingress exposure changes the security outcome

The same defect has very different consequences depending on where NGINX sits. When NGINX is used as an ingress controller, gateway, or edge reverse proxy, the vulnerable code becomes reachable from the public internet and sits in front of multiple applications and identity-dependent workflows. That placement increases both availability impact and the chance that a crash affects authentication, session, and API traffic all at once. The article’s proof-of-concept data shows that even a small number of requests can kill multiple workers, which makes exposure context central to prioritisation.

Practical implication: Inventory externally reachable NGINX instances and prioritise those in front of critical application or identity traffic.

Why some environments may move from outage to code execution

The article says the primary outcome is denial of service, but certain environments may also be susceptible to remote code execution. Heap corruption does not guarantee code execution, yet it can become an execution primitive when memory layout, protection settings, and exploit chaining conditions line up. That is why attacker capability depends on environment specifics such as exploit mitigations, surrounding libraries, and whether additional memory disclosure or grooming techniques are available. The operational lesson is that a crash-only view understates the risk profile of memory safety bugs in core traffic infrastructure.

Practical implication: Treat a DoS-only mindset as incomplete when the vulnerable component is a privileged traffic gateway.

Threat narrative

Attacker objective: The attacker aims to disrupt service availability and, where conditions permit, gain execution within the NGINX runtime path.

1. Entry occurs through an unauthenticated, specially crafted HTTP request sent to the vulnerable NGINX rewrite path.
2. The request triggers heap memory corruption in the worker process, producing a reliable crash condition and service instability.
3. In some environments, the same corruption may be leveraged further toward remote code execution and deeper infrastructure compromise.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ingress-layer vulnerabilities create identity-adjacent blast radius: A flaw in NGINX is not just a web server problem when NGINX fronts authentication, session, API, and gateway traffic. The control failure is that a public request path can take down the traffic layer that many identity-dependent services rely on. Practitioners should treat edge placement as part of the risk model, not as background infrastructure detail.

Parser bugs become governance problems when exposure is uncontrolled: The vulnerability is reachable without authentication, which means asset placement and reachability determine whether the flaw is theoretical or operational. This is exactly where risk programmes that focus only on severity scores miss the point. The material question is which internet-facing instances are carrying critical workload and identity traffic.

Rewrite-rule complexity is a hidden attack surface: Unnamed captures and conditional rewrite logic expand the number of configurations that can turn a parser error into a crash. That means operational convenience can create a fragile security boundary. Teams should regard rewrite logic as part of the trusted computing perimeter, not as harmless routing glue.

Remote code execution risk depends on memory-safety assumptions that edge operators often overestimate: The article shows that DoS is the baseline outcome, but heap corruption can become code execution in certain environments. That gap matters because it exposes an assumption that crash-only impact is good enough for prioritisation. Security leaders should judge edge flaws by the reachable runtime context, not by the easiest exploit path alone.

Blast-radius analysis should supersede static severity triage: CVSS 9.2 is a starting point, not the decision. What changes the remediation order is whether the vulnerable NGINX instance protects critical ingress, whether it is publicly reachable, and whether it can interrupt multiple downstream services at once. The practitioner takeaway is to prioritise by exposure and business dependency, not by score alone.

What this signals

Rewrite logic belongs in the threat model for edge infrastructure: Teams often treat routing rules as operational convenience, but this vulnerability shows that request transformation logic can become an externally reachable attack surface. When edge components translate untrusted input before policy enforcement, a parser bug can become a platform outage.

Exposure context should drive patch priority: The same NGINX version may be low urgency on an isolated internal host and high urgency on a public ingress gateway. Security teams should rank remediation by runtime reachability and downstream dependency, because the blast radius is determined by placement as much as by flaw severity.

For practitioners

• Patch exposed NGINX instances first Upgrade NGINX Open Source to 1.30.1 or 1.31.0 and NGINX Plus to R32 P6 or R36 P4 on systems reachable from untrusted networks.
• Replace unnamed rewrite captures Where immediate patching is impossible, change rewrite directives that use unnamed captures such as $1 or $2 to named captures to remove the vulnerable condition.
• Prioritise internet-facing ingress paths Map every NGINX deployment to its runtime reachability, then rank externally exposed ingress controllers, gateways, and reverse proxies ahead of internal-only instances.
• Separate DoS risk from code-execution risk Review whether the affected runtime has exploit mitigations, memory protections, or adjacent conditions that could make heap corruption more than an outage issue.

Key takeaways

• A memory corruption flaw in NGINX rewrite handling can be triggered without authentication and can crash worker processes reliably.
• Orca Security reports that the issue affects NGINX Open Source and NGINX Plus, with public proof-of-concept activity raising the likelihood of opportunistic exploitation.
• The right remediation order is to patch exposed ingress paths first and use named captures as a temporary mitigation where patching is delayed.

Key terms

• Rewrite Module: The NGINX component that evaluates rewrite, redirect, and URL manipulation rules before a request reaches upstream services. It can change request paths, arguments, and response behaviour, which makes it security-sensitive when exposed on public traffic paths.
• Heap Buffer Overflow: A heap buffer overflow happens when a process writes past the end of a memory buffer allocated on the heap. In NGINX-style worker processes, that corruption can crash the process, corrupt adjacent state, or, in the right conditions, become a route to code execution.
• Ingress Controller: A Kubernetes component that manages how external traffic reaches services inside the cluster. Because it sits at the edge, an ingress controller is part of the exposure path, not just plumbing. If it inherits vulnerable proxy behaviour, the risk spreads to many workloads at once.
• Unauthenticated Network Exploitation: An attack path that works before any valid login, token, or session is established. The attacker sends crafted traffic directly to a reachable service and relies on the server to process it unsafely. This pattern raises urgency because traditional identity controls do not block the initial exploit attempt.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.