# 18-Year-Old NGINX Rewrite Module Vulnerability Exposes Millions to Unauthenticated Code Execution


## The Threat


Researchers at depthfirst have disclosed a critical heap buffer overflow vulnerability in NGINX's HTTP rewrite module that has persisted undetected since 2008. Tracked as CVE-2026-42945, this flaw allows unauthenticated attackers to trigger remote code execution or cause denial of service on affected NGINX instances without authentication or specialized privileges.


The vulnerability exists in the ngx_http_rewrite_module component, which handles URL rewriting and pattern matching—core functionality present in virtually every NGINX deployment. An attacker crafting a malicious HTTP request containing specially constructed rewrite directives can overflow a heap buffer, corrupting memory and potentially executing arbitrary code with the privileges of the NGINX worker process. Since NGINX typically runs as root or with elevated privileges in many production configurations, successful exploitation poses severe risks.


The fact that this critical flaw remained undiscovered for 18 years underscores a broader challenge in open-source security: code auditing depth varies significantly, and even widely-deployed components can harbor long-lived vulnerabilities. NGINX powers approximately 33% of all websites globally, meaning millions of internet-facing systems may be exposed to active exploitation if patches are not deployed quickly.


## Severity and Impact


| Attribute | Details |

|-----------|---------|

| CVE | CVE-2026-42945 |

| CVSS v4 Score | 9.2 (Critical) |

| CVSS Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:U/SI:U/SA:U |

| Attack Complexity | Low — no special conditions required |

| Authentication | None required |

| Attack Vector | Network — remotely exploitable |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |


The critical CVSS v4 rating reflects the combination of network-based, unauthenticated attack surface with complete system compromise potential. The heap overflow can be triggered via standard HTTP requests, making exploitation trivial once an attacker understands the trigger conditions.


## Affected Products


  • NGINX Open Source: versions prior to 1.27.0 (all versions from 0.1.x through 1.26.x)
  • NGINX Plus: versions R1 through R35 (released before April 2026)
  • Derivative distributions:

    • - Debian: nginx package versions < 1.27.0-1~debian

    - Ubuntu: nginx package versions < 1.27.0-1~ubuntu

    - Red Hat Enterprise Linux: nginx package versions < 1.27.0-1.el*

    - CentOS: nginx package versions < 1.27.0-1.centos

    - Alpine Linux: nginx package versions < 1.27.0-r0

    - Docker Official NGINX Images: tags < 1.27-alpine, < 1.27-bookworm, < 1.27-jammy (all variants)


    Organizations running NGINX in containerized, cloud-native, or traditional server environments are affected unless they have already updated to patched versions.


    ## Mitigations


    Immediate Actions:

    1. Update NGINX immediately to version 1.27.0 or later for Open Source, or R36+ for NGINX Plus. This is a critical priority — treat this as a P0 incident requiring emergency patching windows.

    2. Apply vendor patches from your distribution provider (Debian, Ubuntu, Red Hat, etc.) rather than compiling from source when possible to ensure supply-chain consistency.

    3. Rebuild Docker containers using updated base images or rebuild locally with patched NGINX.


    Short-Term Workarounds (if patching cannot be completed immediately):

  • Disable the rewrite module if your application does not depend on URL rewriting: recompile NGINX with --without-http_rewrite_module.
  • Network segmentation: Restrict NGINX access to internal-only or VPN-authenticated networks temporarily while patches are deployed.
  • WAF rules: Deploy Web Application Firewall rules that block HTTP requests containing suspicious rewrite directive patterns, though this is imperfect and not a substitute for patching.

    • Detection:

  • Monitor NGINX error logs for segmentation faults or unexpected crashes in worker processes (sign of exploitation attempts).
  • Enable NGINX debug logging to detect malformed rewrite directives being processed.
  • Implement network-based intrusion detection signatures specific to CVE-2026-42945 (contact your IDS vendor for rules).

    • Long-Term:

  • Adopt a patch management process that prioritizes critical NGINX CVEs within 48 hours of disclosure.
  • Automate NGINX updates in staging environments at minimum.
  • Consider managed NGINX services (AWS ALB, Google Cloud Load Balancing) that handle patching transparently.

    • ## References


  • [NGINX Security Advisory](https://nginx.org/security/) — official vulnerability details and patch availability
  • [depthfirst Research Publication](https://depthfirst.io/) — original discovery and technical analysis
  • [CVE-2026-42945 NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-42945)
  • [NGINX Plus Release Notes](https://docs.nginx.com/nginx-plus/release-notes/) — R36+ security fixes
  • [NGINX Documentation: Rewrite Module](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html)

    • ---


    ## HackWire Analysis


    The 18-year window between this vulnerability's introduction and discovery is not an anomaly—it's a warning that should reshape how organizations prioritize open-source auditing. The rewrite module is not exotic or rarely-used; it's fundamental infrastructure that thousands of teams deploy daily without security review. This is how mature, battle-tested code becomes a single point of catastrophic failure: surface-level familiarity breeds complacency, and funding for deep security audits of "stable" components evaporates.


    What's particularly alarming is the attack profile. This isn't a vulnerability requiring social engineering, physical access, or specific system misconfigurations. A single malicious HTTP request from the internet can compromise an NGINX server. For organizations running NGINX at scale—cloud platforms, CDN providers, e-commerce sites—this creates a window of exposure measured in minutes from the moment an exploit becomes public. The time-to-patch for critical infrastructure components is typically measured in hours or days, not minutes.


    The timing also matters: NGINX represents the web's plumbing. Attacks exploiting CVE-2026-42945 are likely to target bulk exploitation campaigns against known NGINX IP ranges and hostnames. Organizations operating in cloud environments where NGINX is auto-deployed should assume that patch availability does not equal patch deployment; standard infrastructure-as-code setups may still spin up vulnerable instances from cached AMIs or outdated container images for weeks.


    Defenders should treat this as a mandatory incident: audit all NGINX instances today, prioritize patches in production by EOD, and review logs for exploitation attempts over the past 18 years (though detection post-facto is difficult). Vendors should consider whether other core, "stable" modules deserve the same urgency audit treatment. This is a reminder that longevity and adoption are not substitutes for security rigor.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)