CVE-2026-42945: the NGINX Rift rewrite overflow

02Who is affected, and under what configuration?

Open source nginx from 0.6.27 through 1.30.0 is vulnerable. F5 also lists NGINX Plus R32 through R36 and other F5 products built on the same engine, such as NGINX Ingress Controller and NGINX Gateway Fabric; the F5 advisory has the full product list. If you run a product that embeds nginx, treat it as affected until the vendor says otherwise.

Being on an affected version is necessary but not sufficient. Exposure also requires the vulnerable directive shape. The upstream fix commit documents the minimal reproducer below, which captures the two ingredients: a question mark in the rewrite replacement, and a later directive that reads an unnamed capture.

• A rewrite replacement that contains a question mark (it starts a query string)
• A following rewrite, if or set directive in the same context
• An unnamed capture reference such as $1 or $2 in that following directive
• An affected nginx version (open source 0.6.27 to 1.30.0, or a listed F5 product)

location / {
    rewrite ^(.*) /new?c=1;   # '?' sets the internal is_args flag
    set $myvar $1;            # reads an unnamed capture afterwards
    return 200 $myvar;
}

03How does the overflow happen?

nginx compiles rewrite and set directives into a small script programme that runs in two passes. The first pass measures how many bytes the result will need and allocates exactly that much from the request pool. The second pass copies the data in. The design is fast because it allocates once, but it is only safe if the two passes agree on the length.

When a rewrite replacement contains a question mark, nginx sets an internal flag meaning "what follows is a query string". In the affected code that flag was never cleared. The length pass ran on a freshly zeroed sub-engine where the flag was unset, so it measured a capture as raw bytes. The copy pass ran on the main engine where the flag was still set, so it re-escaped the same capture as a query-string argument, expanding characters such as plus, percent and ampersand. The copy therefore wrote more bytes than were allocated, and the surplus landed outside the buffer.

Because the overflowing bytes come from the attacker's URI, the corruption is shaped by the attacker rather than random. Repeated requests also keep workers in a crash-and-restart loop, which is a denial of service in its own right even where code execution is not achievable.

04How do I check whether I am affected?

Two checks matter: your version, and your configuration. Confirm the running version first, then audit the full merged configuration rather than individual files, because the dangerous combination can be split across an include.

# 1. version and distro package
nginx -v
dpkg -l | grep -E '^ii\s+nginx'      # Debian/Ubuntu

# 2. dump the full merged config, then audit it
nginx -T 2>/dev/null > /tmp/nginx-full.conf

# rewrite replacements that contain a '?'
grep -nE '^\s*rewrite\s+\S+\s+[^ ;]*\?' /tmp/nginx-full.conf

# set/if/rewrite directives that read an unnamed capture
grep -nE '^\s*(set|if|rewrite)\b.*\$[1-9]' /tmp/nginx-full.conf

05How do I fix or mitigate it?

The fix is to upgrade. Open source nginx 1.31.0 (mainline) and 1.30.1 (stable) contain the patched code; restart nginx after upgrading so workers reload the new binary. NGINX Plus users should move to R36 P4 or R32 P6, or to the PLS.37 release line, which shipped with the fix; the NGINX Plus release notes list no patch for R33 to R35. The upstream patch is a one-line change that resets the query-string flag at the end of each rewrite, so later directives measure and copy captures the same way. General bounds checks on script copies only arrived later, in nginx 1.31.3 and 1.30.4.

Distribution packages carry the fix under their own version numbers. On Debian it landed in nginx 1.22.1-9+deb12u7 for bookworm (DSA-6278-1) and 1.26.3-3+deb13u5 for trixie; on Ubuntu, 1.24.0-2ubuntu7.8 for noble and 1.18.0-6ubuntu14.11 for jammy (USN-8271-1). Match the package version, not the upstream number; why an old nginx/1.18.0 banner is usually already patched explains the difference.

If you genuinely cannot upgrade immediately, remove the trigger: wherever a directive after a rewrite with a question mark reads $1 or $2, capture the value with a named group instead and read the name. Named captures are stored as ordinary variables and do not go through the vulnerable escaping path.

# vulnerable shape: '?' in the replacement, then $1 read by a later directive
rewrite ^/old/(.*)$ /new?from=old;
set $orig_path $1;

# mitigated: the later directive reads a named capture
rewrite ^/old/(?<old_path>.*)$ /new?from=old;
set $orig_path $old_path;

06What can a WAF or reverse proxy do about it?

Be honest about the limits here. CVE-2026-42945 is a bug in nginx's own request processing, so if your vulnerable nginx is the thing terminating the request, no filter running inside that same nginx can reliably save it. The corruption happens during the rewrite phase, early and inside the worker.

Where an upstream proxy genuinely helps is as a separate tier. If a patched reverse proxy terminates connections and forwards clean, normalised requests to an origin, the origin's exposure is reduced, and the crash-loop denial-of-service angle is absorbed the same way any HTTP flood is. A proxy can also drop obviously malformed URIs. What it cannot do is turn an unpatched origin into a safe one, which is why edge filtering is a supplement to patching, never a replacement; what virtual patching can and cannot do sets out that boundary. A reverse proxy such as GuardX absorbs flood traffic before it reaches the origin, but the origin still has to be patched.

For the wider playbook on keeping an origin reachable under attack, see how to stop a DDoS attack and what a web application firewall is.

07The follow-up: CVE-2026-9256 and the map overflows

The same escaping logic produced a second bug nine days later. CVE-2026-9256 is a heap overflow when a rewrite uses overlapping captures such as ^/((.*))$ and the replacement references more than one of them (for example $1$2) in a redirect or arguments context. It was disclosed on 22 May 2026 and fixed in nginx 1.31.1 and 1.30.2. The mitigation is the same: avoid unnamed captures, and upgrade.

The rewrite engine was not the end of it. Later in 2026 a closely related script-engine desynchronisation surfaced in the map directive, and a separate heap overflow in alias handling after a rewrite. If you are patching for Rift, patch for those at the same time: see the nginx map heap overflow and the October 2026 alias/rewrite release.

08Timeline