Reported by 2 outlets
NGINX Rift (CVE-2026-42945) — Active exploitation confirmed over the weekend, 5.7M exposed servers
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
NGINX Rift (CVE-2026-42945) — Active exploitation confirmed over the weekend, 5.7M exposed servers
securityweek.com · 149d ago · May 18th, 2026
VulnCheck has confirmed active in-the-wild exploitation of CVE-2026-42945 ("NGINX Rift"), the critical heap buffer overflow in NGINX's
ngx_http_rewrite_modulethat went undetected for 18 years. Public PoC code was published last week by Depthfirst; over the weekend, VulnCheck detected attacks hitting its canary systems. Censys data shows approximately 5.7M internet-exposed NGINX servers running potentially vulnerable versions, though the exploitable subset requires specificrewriteconfigurations. The heap overflow can achieve RCE when ASLR is disabled, and the public PoC reportedly includes an ASLR bypass mechanism. F5 released patches last week — any deployment usingrewriteorsetdirectives should treat this as an emergency patching priority. -
update from gbhackers.com
NGINX Rift (CVE-2026-42945) — Active Exploitation Confirmed, 5.7M Exposed Servers
gbhackers.com · 148d ago · May 19th, 2026
Attackers are sending crafted HTTP requests to trigger heap buffer overflows in the NGINX worker process. The rewrite-only exploitation constraint reduces but does not eliminate the attack surface.