NGINX Rift: 18-Year-Old Heap Overflow Triggers Emergency Patching Across Web Infrastructure

A critical heap buffer overflow in NGINX—powering approximately one-third of all websites globally—has forced emergency patching across millions of servers after an AI-powered security analysis uncovered a vulnerability that existed undetected for 18 years.

CVE-2026-42945, disclosed May 13 with a CVSS score of 9.2, enables unauthenticated remote code execution or denial-of-service attacks against NGINX configurations using specific rewrite patterns in the ngx_http_rewrite_module. The flaw, present since version 0.6.27 in 2008, was discovered by depthfirst‘s autonomous vulnerability analysis system within six hours of scanning the codebase—a timeline that underscores both the power of AI-driven code review and the brittleness of manual security audits for foundational infrastructure.

Attack Surface and Exploitation Mechanics

The vulnerability requires no authentication and can be triggered with a single HTTP request, according to The Hacker News. Exploitation hinges on a specific configuration pattern: rewrite directives using unnamed PCRE captures ($1, $2) with replacement strings containing ‘?’ followed by another rewrite, if, or set directive. This pattern appears commonly in PHP applications, WordPress installations, and API gateways performing URL normalization.

The attack path bifurcates based on system hardening. Denial-of-service through worker process crashes is trivial on all configurations—AlmaLinux maintainers confirmed reliable crashes with single crafted requests across versions on AlmaLinux 8, 9, and 10. Remote code execution is achievable on systems with ASLR disabled or through sophisticated heap manipulation techniques demonstrated in the public proof-of-concept published alongside disclosure.

The exploitation strategy leverages NGINX’s process management behavior. When a worker crashes, the master process spawns a replacement with identical memory layout, allowing attackers to retry exploitation attempts without penalty—a characteristic that transforms failed RCE attempts into sustainable attacks rather than one-shot failures, according to Bleeping Computer‘s analysis of the exploit code.

Patch Availability and Deployment Complexity

Patches shipped immediately upon disclosure. NGINX open source versions 1.30.1 and 1.31.0 contain fixes, while NGINX Plus customers received patches in R32 P6 and R36 P4, according to NGINX security advisories. AlmaLinux rolled patched packages to production repositories within 24 hours of disclosure, covering NGINX versions across AlmaLinux 8, 9, and 10.

Deployment complexity varies by infrastructure architecture. Bare-metal and virtual machine deployments face standard package update procedures. Containerized workloads require base image rebuilds and redeployment across orchestration platforms. NGINX ingress controllers in Kubernetes environments introduce additional testing overhead—organizations must validate that patched versions maintain compatibility with existing routing rules and application backends before production rollout.

A temporary workaround exists for organizations unable to patch immediately: replacing unnamed PCRE captures with named captures (e.g., changing $1 to (?<user_id>[0-9]+)) in vulnerable rewrite directives eliminates the trigger condition, according to Security Affairs. This mitigation requires configuration audits across potentially thousands of server blocks and virtual hosts—a nontrivial task for large deployments.

AI-Driven Discovery and Security Implications

The discovery methodology carries implications beyond this single vulnerability. depthfirst’s autonomous system identified CVE-2026-42945 through static analysis techniques that human reviewers failed to apply consistently over the NGINX development lifecycle. The six-hour discovery timeline suggests AI-powered code review can achieve vulnerability detection rates that scale independently of codebase size or reviewer availability.

F5 Networks simultaneously patched four additional vulnerabilities alongside CVE-2026-42945: CVE-2026-42946 (CVSS 8.3, SCGI/UWSGI memory allocation), CVE-2026-40701 (CVSS 6.3, OCSP use-after-free), CVE-2026-42934 (CVSS 6.3, charset module out-of-bounds read), and CVE-2026-42926 (medium severity, HTTP/2 proxy injection), according to The Hacker News. The batch patching suggests a systematic code review following the initial discovery rather than isolated findings.

Economic and Operational Impact

Organizations face compounding costs beyond direct patching labor. Incident response teams must audit configurations to determine exposure, test patches in staging environments, and coordinate maintenance windows across globally distributed infrastructure. Hosted service providers carry supply chain risk—customers of platforms running vulnerable NGINX versions inherit exposure through dependency rather than direct deployment.

The threat landscape four days post-disclosure shows no confirmed in-the-wild exploitation, per Security Affairs, but public PoC availability and unauthenticated attack surface create rapid weaponization risk. Historical patterns suggest 7-14 day windows between critical web server vulnerability disclosure and mass scanning activity.

What to Watch

Monitor honeypot networks and intrusion detection logs for HTTP requests matching the exploit pattern—specifically rewrite-triggered heap overflows targeting ngx_http_rewrite_module. Track security vendor feeds for reports of automated exploitation attempts or incorporation into exploit frameworks. Watch for secondary discoveries as security teams apply similar AI analysis techniques to other long-lived web infrastructure codebases. Kubernetes ingress controller vendors should publish compatibility statements for patched NGINX versions within 72 hours. Organizations running NGINX Plus should verify patch deployment through F5 support channels rather than assuming automatic updates. The gap between patch availability and enterprise deployment completion represents the window of maximum exposure—expect 30-90 day remediation cycles for complex deployments despite immediate patch availability.