NGINX Rift shows how a small rewrite-rule pattern can become a large operational risk. The flaw is not a universal one-request takeover, but exposed NGINX estates should still treat patching and configuration review as urgent.
NGINX is facing renewed scrutiny after the disclosure of a configuration-dependent vulnerability that exposes a long-overlooked attack surface in web infrastructure. The issue, tracked as CVE-2026-42945 and referred to as NGINX Rift, affects both NGINX Open Source and NGINX Plus through a flaw in the ngx_http_rewrite_module.
At its core, the vulnerability is a heap-based buffer overflow triggered under specific rewrite rule conditions. According to F5, exploitation requires a combination of directives, including a rewrite followed by another rewrite, if, or set directive, alongside the use of unnamed PCRE captures such as $1 or $2. If these are paired with a replacement string containing a question mark, a specially crafted HTTP request can corrupt memory within an NGINX worker process. This can result in worker crashes and service disruption. In environments where Address Space Layout Randomisation is disabled, the risk escalates to potential remote code execution.
What makes this disclosure notable is not just the technical detail, but its age and reach. Security researcher depthfirst, who reported the issue, describes it as an 18-year-old flaw embedded in widely deployed configurations. Because NGINX often operates at the front line of web infrastructure, handling inbound traffic before it reaches application layers, even niche configuration weaknesses can have broad exposure.
The US National Vulnerability Database classifies the issue as CWE-122, a heap-based buffer overflow, and assigns a CVSS 3.1 score of 8.1, placing it in the high severity category. F5, acting as the CNA, has also issued its own advisory with a critical rating under CVSS v4, signalling elevated concern for certain deployment scenarios.
This vulnerability highlights a persistent blind spot in enterprise security. Many organisations focus on patching software versions but pay less attention to configuration logic, particularly in mature and trusted components like NGINX. Because the flaw can be triggered remotely over HTTP and sits in a widely used module, it increases the risk profile of otherwise stable deployments.
It also reinforces a broader trend in modern exploitation, where attackers target edge infrastructure and misconfigurations rather than relying solely on newly introduced bugs. For organisations running NGINX, especially in high-traffic or internet-facing roles, reviewing rewrite rules and configuration patterns is now a necessary defensive step.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
US authorities have dismantled QTFY’s QScan and QTRouter platforms, exposing a China-linked service model that blended exploit trading, automated scanning and hijacked IoT devices to reach critical infrastructure while concealing where attacks began.
Australia’s cyber agency is warning that attackers are exploiting two N-able N-central authentication bypass flaws locally. For MSPs and enterprise IT teams, a trusted management console can become a route across hundreds of customer endpoints.
A record close on Wall Street and the AI names that were meant to lead it taken apart in the same session. Beijing is now drafting export controls on its own models. The labs keep finding their systems outside the box. Read one at a time, it is a normal week. Read together, something else entirely.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
