Vulnerability Overview

Disclosed in June 2026, CVE-2026-42945 is a critical heap buffer overflow vulnerability in the NGINX rewrite module (ngx_http_rewrite_module).

With a CVSS score of 9.2, this vulnerability allows unauthenticated remote attackers to trigger a segmentation fault (causing a server-wide denial of service) or potentially achieve remote code execution (RCE) under specific memory layouts by sending crafted URI requests containing malformed redirection configurations.

Technical Details

The vulnerability lies in how the ngx_http_rewrite_handler parses and reconstructs redirection URLs containing capture groups from regular expressions.

When NGINX handles a rewrite rule that evaluates complex capturing rules, it allocates a buffer on the heap using ngx_palloc(). However, if the parsed URL has a combination of specific percent-encoded unicode sequences, the string length calculation fails to account for buffer resizing, leading to a heap buffer overflow.

Attack Vector

1. An attacker crafts a URL containing specific unicode representations designed to trigger integer wrapping in string length calculations.
2. The request matches a configured rewrite regex rule on the target NGINX server.
3. The rewrite module processes the replacement string and copies the output onto a pre-allocated heap buffer.
4. The data overflows the bounds of the heap chunk, corrupting adjacent allocator metadata.

Mitigation & Remediation

Web administrators should apply patches to their gateway infrastructure immediately.

1. Upgrade NGINX

Upgrade NGINX to version 1.29.8 or higher (stable) or 1.31.1 or higher (mainline) where the rewrite module's string copying safety bounds have been reinforced.

# Verify version
nginx -V

2. Disable Complex Redirection Rules (Mitigation)

If upgrading is not possible, audit your nginx.conf and temporarily simplify complex rewrite/return regex rules that rely on nested capture groups or custom redirect configurations.