Reported by 1 outlet
NGINX Rift — 18-year-old heap buffer overflow enables unauthenticated RCE on ~33% of all websites
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
NGINX Rift — 18-year-old heap buffer overflow enables unauthenticated RCE on ~33% of all websites
gbhackers.com · 153d ago · May 14th, 2026
An AI-powered code analysis system by depthfirst has discovered CVE-2026-42945 ("NGINX Rift"), a critical heap buffer overflow in NGINX's
ngx_http_rewrite_modulepresent since version 0.6.27 (2008). The flaw carries CVSS v4.0 9.2 and affects every NGINX release through 1.30.0. The vulnerability stems from a two-pass script engine used forrewriteandsetdirectives: a?character permanently sets an internalis_argsflag on the main engine that is not propagated to the sub-engine used during length calculation, causing the copy phase to write more data than allocated. Unauthenticated attackers can trigger the overflow via crafted HTTP requests containing+,&, or%URI characters. A working PoC achieving full RCE with ASLR disabled has been published on GitHub, with theoretical ASLR bypass via progressive heap pointer corruption across multiple requests. NGINX's multi-process architecture allows unlimited exploit retries without permanent service disruption. F5 released patches on May 13: upgrade to NGINX 1.31.0 or 1.30.1 immediately. Three additional vulnerabilities were found by the same analysis (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934).