Heap Buffer Overflow in NGINX ngx_http_rewrite_module via PCRE Capture
CVE-2026-42945 Published on May 13, 2026

NGINX ngx_http_rewrite_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-42945 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Incorrect Calculation of Buffer Size

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.


Products Associated with CVE-2026-42945

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42945 are published in these products:

F5 Networks Nginx Plus
 
F5 Networks Nginx Open Source
 
Canonical Ubuntu Linux
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 
Red Hat Hummingbird
 
Red Hat Openshift Data Foundation
 
Red Hat Satellite
 
Red Hat Rhui
 
Red Hat 3scale Amp
 
Red Hat Insights Proxy
 

Affected Versions

F5 NGINX Plus: F5 NGINX Open Source: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Hardened Images: Red Hat Openshift Data Foundation 4.14: Red Hat Openshift Data Foundation 4.14: Red Hat Openshift Data Foundation 4.14: Red Hat Openshift Data Foundation 4.15: Red Hat Openshift Data Foundation 4.15: Red Hat Openshift Data Foundation 4.15: Red Hat Openshift Data Foundation 4.16: Red Hat Openshift Data Foundation 4.16: Red Hat Openshift Data Foundation 4.16: Red Hat Openshift Data Foundation 4.17: Red Hat Openshift Data Foundation 4.17: Red Hat Openshift Data Foundation 4.17: Red Hat Openshift Data Foundation 4.18: Red Hat Openshift Data Foundation 4.18: Red Hat Openshift Data Foundation 4.18: Red Hat Openshift Data Foundation 4.19: Red Hat Openshift Data Foundation 4.19: Red Hat Openshift Data Foundation 4.19: Red Hat Openshift Data Foundation 4.2: Red Hat Openshift Data Foundation 4.2: Red Hat Openshift Data Foundation 4.2: Red Hat Openshift Data Foundation 4.21: Red Hat Openshift Data Foundation 4.21: Red Hat Openshift Data Foundation 4.21: Red Hat Satellite 6.18: Red Hat Satellite 6.19: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat 3scale API Management Platform 2: Red Hat Lightspeed proxy 1:

Exploit Probability

EPSS
23.02%
Percentile
97.46%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.