NGINX Rift, CVE-2026-42945: An 18-Year-Old Bug in the Rewrite Module

What NGINX Rift actually is

CVE-2026-42945 is a heap-based buffer overflow (CWE-122) in the ngx_http_rewrite_module, the part of nginx responsible for URL rewriting and redirection logic. According to F5's own advisory, an unauthenticated attacker can send a specially crafted request that triggers a mismatch between how nginx calculates the size of a destination buffer and how it actually writes data into it, overflowing the buffer on the heap. At minimum this crashes the affected nginx worker process, which nginx then restarts, causing a denial-of-service condition. On a system where address space layout randomization is disabled, or where an attacker has a way to defeat it, the same overflow can be leveraged for remote code execution.

What triggers the overflow

The vulnerable pattern is specific: a rewrite directive that uses an unnamed PCRE capture group, such as $1 or $2, in a replacement string that contains a question mark, followed in the same location block by another rewrite, if, or set directive. When that sequence occurs, nginx computes the size needed for the destination buffer using one escaping method, but writes the actual output using a different escaping method, and the two disagree about how much space is required. That mismatch is what overflows the buffer. It is a narrow, specific pattern, not a flaw in URL rewriting generally, which is exactly why it went unnoticed through 18 years of otherwise heavy real-world use of the rewrite module.

Why an 18-year-old bug surfaced now

Bugs like this are typically found through fuzzing or targeted code auditing of widely deployed software, not through normal usage, since the trigger condition depends on a configuration detail that most administrators would never think to test deliberately. Once F5 and the nginx project disclosed the flaw and shipped a fix, proof-of-concept exploit code followed quickly, and multiple sources reported exploitation attempts shortly after. This is the same pattern our patch management guide covers in depth: the moment a fix is public, so is enough information for attackers to build a working exploit, and the clock on how long an unpatched server stays safe starts running immediately.

Who is affected

Every release of nginx Open Source from 0.6.27 through 1.30.0 is affected, along with nginx Plus releases R32 through R36. Given how far back 0.6.27 dates, this covers effectively every nginx deployment that has not been kept current, not a narrow recent release window. According to AlmaLinux's advisory, most major Linux distributions moved quickly to backport the fix into their maintained nginx packages once it was available upstream.

How to check your configuration

nginx -v
grep -rn "rewrite" /etc/nginx/

Look through the matched rewrite directives for one that uses an unnamed capture group, $1, $2, and so on, inside a replacement string containing a question mark, and check whether the same location block also contains a following rewrite, if, or set directive. If you find that exact combination on an affected version, treat it as confirmed exposure. If you do not find it, the specific code path is not reachable even on an unpatched version, though upgrading remains the correct move since new configuration changes could introduce the pattern later without anyone noticing.

How to fix it

Upgrade to nginx 1.30.1 or later if you track the stable branch, or 1.31.0 or later on mainline. On Debian and Ubuntu, sudo apt update && sudo apt install nginx applies the fix once your distribution has backported it into its maintained package; on RHEL-family systems, sudo dnf upgrade nginx is the equivalent. Always verify the installed version afterward with nginx -v rather than assuming the upgrade succeeded, and confirm the service restarted cleanly with systemctl status nginx.

If an immediate upgrade is not possible, removing or rewriting the specific triggering configuration pattern, an unnamed capture with a question mark followed by another rewrite, if, or set directive in the same location, closes the exposure without touching the nginx binary itself, though this is a stopgap and not a substitute for patching.

The broader lesson

NGINX Rift is a good example of why "we have always run this configuration and never had a problem" is not the same thing as "this configuration is safe." The vulnerable code path in this case had been present since 0.6.27 and had nothing to do with unusual or exotic setups; it depended on a specific but not particularly rare pattern in rewrite directives that plenty of real configurations use for clean URLs, redirects, and query string handling. Keeping nginx itself current, not just the configuration around it, is the only reliable defense against a class of bug that lives in code nobody has reason to suspect until someone specifically goes looking for it. Our nginx security best practices guide covers the configuration side in depth; this CVE is a reminder that the software underneath the configuration needs the same attention.