# 18-Year-Old NGINX Heap Overflow Lets Attackers Crash Servers and Run Code—Patch Now
## The Threat
An 18-year-old vulnerability lurking in NGINX's rewrite module has been publicly disclosed with a critical severity rating of 9.2 CVSS. The flaw, tracked as CVE-2026-42945, is a heap buffer overflow that can be triggered remotely without authentication through specially crafted HTTP requests. Because NGINX powers roughly one-third of the internet's top-ranked websites and is widely deployed in cloud infrastructure, Kubernetes clusters, and enterprise reverse proxy setups, the exposure is enormous.
The vulnerability exists in NGINX's internal script engine when configurations use both the 'rewrite' and 'set' directives in tandem—a pattern that is extremely common in API gateways, load balancers, and reverse proxy deployments. The flaw stems from a state-handling bug: an 'is_args' flag remains set after a rewrite containing a query string ('?'), causing NGINX to miscalculate buffer sizes. The engine allocates memory based on unescaped URI lengths but then attempts to write larger, escaped data (like '+' and '&' characters), triggering a heap overflow that corrupts adjacent memory structures.
The immediate risk is a denial-of-service condition that crashes NGINX worker processes. However, researchers at DepthFirst AI demonstrated that under certain conditions—specifically when Address Space Layout Randomization (ASLR) is disabled—the buffer overflow can be weaponized for unauthenticated remote code execution. While ASLR is enabled by default on most systems, it is sometimes deliberately disabled in embedded systems, virtual machines, and analysis environments. The fact that RCE is possible at all, even with mitigations disabled, elevates the threat profile significantly.
## Severity and Impact
| Attribute | Details |
|---|---|
| Primary CVE | CVE-2026-42945 |
| CVSS Score | 9.2 (Critical) |
| CWE | CWE-122 (Heap-based Buffer Overflow) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
Three additional memory corruption vulnerabilities were discovered during the same automated code scan and are included in F5's advisory:
## Affected Products
NGINX Open Source:
NGINX Plus:
NGINX Instance Manager:
F5 WAF for NGINX:
NGINX App Protect WAF:
NGINX App Protect DoS:
Note: The vulnerability has been present in NGINX for approximately 18 years, meaning all versions from mid-2008 forward are impacted unless patched.
## Mitigations
Immediate actions:
1. Apply patches without delay. F5 has released fixed versions for all affected product lines. Organizations should prioritize patching NGINX Open Source 1.30.1+ and corresponding NGINX Plus releases immediately.
2. Disable rewrite + set directive combinations if patching is delayed. If immediate patching is not possible, audit NGINX configurations to identify instances where both 'rewrite' and 'set' directives are used together. Disable these rules or simplify them to use only one directive until patches can be applied.
3. Enable ASLR on all systems. While ASLR is typically enabled by default, verify it is active on all servers running NGINX—particularly in embedded systems, containerized environments, and analysis VM clusters where it may have been disabled. ASLR significantly raises the bar for reliable exploitation.
4. Network segmentation and WAF rules. Implement network policies restricting NGINX exposure to only required clients. Deploy WAF rules to detect and block malformed HTTP requests that might trigger the buffer overflow.
5. Monitor for exploit attempts. Watch access logs for requests containing unusual URI encoding, excessive query string lengths, or repeated failed requests that might indicate reconnaissance or exploitation attempts.
6. Update dependent services. If you run NGINX Instance Manager, NGINX App Protect, or F5 WAF, ensure those are upgraded to patched versions as well.
## References
---
## HackWire Analysis
The discovery of an 18-year-old vulnerability in a fundamental internet infrastructure component—and via automated AI-driven scanning rather than traditional security research—should trigger a moment of reckoning in how we think about legacy code and automation in security.
NGINX has been the de facto reverse proxy standard for nearly two decades. An oversight of this magnitude for that long speaks to the limits of human code review, even in open-source projects with millions of eyes. What's striking is that the flaw required a specific configuration pattern (rewrite + set directives together) to trigger, which means it wasn't exploitable in every deployment. This explains why it went undetected—security researchers have traditionally focused on broadly exploitable paths.
DepthFirst AI's success here also highlights the accelerating power of autonomous code scanning. These tools don't get tired, don't favor obvious paths, and can synthesize complex multi-step exploitation chains that human auditors might miss. That's encouraging for defenders, but it also means attackers now have the same leverage. The window for zero-day-grade research has compressed.
The RCE vector deserves special attention: while reliable code execution requires ASLR to be disabled, the researchers explicitly note that they could theoretically use NGINX's multi-process architecture to leak ASLR byte-by-byte and bypass it entirely. This is not theoretical for sophisticated attackers. Any deployment with ASLR disabled—and there are more than you'd expect in embedded systems, CI/CD lab environments, and performance-tuned cloud VM configurations—is exploitable right now.
Organizations running API gateways or load balancers with NGINX should treat this as P0. The attack surface is the entire internet. Patching has no downside and every upside. If you cannot patch immediately, disabling the rewrite+set pattern should be your failsafe, even if it requires temporary architectural workarounds.
— HackWire Editorial
## Related Coverage