tldrdailynews.com logo

18-Year-Old NGINX Flaw Triggers Unauthenticated Remote Code Execution

1 min read
Source: CyberSecurityNews
18-Year-Old NGINX Flaw Triggers Unauthenticated Remote Code Execution
Photo: CyberSecurityNews
TL;DR

A severe heap-buffer-overflow bug in NGINX’s ngx_http_rewrite_module (CVE-2026-42945, CVSS 9.2) allows unauthenticated remote code execution when rewrite and set directives are used together, affecting NGINX Open Source 0.6.27–1.30.0 and several F5/NGINX products; a working PoC is public. Patch guidance includes upgrading to NGINX 1.30.1 or 1.31.0 and auditing configurations that combine rewrite+set directives, with a recommendation to add a WAFlayer until patching is complete. Additional related CVEs include CVE-2026-42946 (high severity, memory corruption), CVE-2026-40701 (medium, use-after-free), and CVE-2026-42934 (medium, out-of-bounds read).

Topics:technologycyber-security#cve-2026-42945#cyber-security#heap-buffer-overflow#nginx#rce#rewritemodule
Share this article
  1. Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks  CyberSecurityNews
  2. 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE  The Hacker News
  3. 18-year-old NGINX vulnerability allows DoS, potential RCE  BleepingComputer
  4. CVE-2026-42945: Critical NGINX Rewrite Flaw  SOC Prime
  5. NGINX is critically vulnerable: hackers can crash servers and run remote code with no authentication  Cybernews

Want the full story? Read the original reporting

Read on CyberSecurityNews