Loading story…
F5 disclosed multiple NGINX vulnerabilities across modules, with the most serious issues centered on the ngx_http_rewrite_module, including CVE-2026-42945 and CVE-2026-9256. The flaw dubbed NGINX Rift is a long-standing heap buffer overflow in the rewrite engine that can be triggered remotely through crafted HTTP requests, leading to worker crashes, repeated restarts, and denial of service; under some conditions, including disabled ASLR, remote code execution is possible. CSIRT.SK reported active exploitation of CVE-2026-42945 and said the bug affects both NGINX Open Source and F5/NGINX-related products, while F5 also published advisories for additional bugs in ngx_http_proxy_v2_module, ngx_http_charset_module, and ngx_http_js_module.
Independent analysis of the two rewrite-engine RCE bugs found that exploitation depends on specific rewrite patterns involving rewrite, if, set, positional captures, and question-mark handling in PCRE-based rules. Researchers behind the ngxray scanner reviewed 35,633 public NGINX configurations from GitHub and found only one confirmed real-world vulnerable configuration after triage, suggesting the bugs are severe but uncommon in exposed public configs. Defenders were urged to upgrade to fixed releases, including NGINX Open Source 1.30.1 or 1.31.0 and NGINX Plus R32 P6 or R36 P4, and to review or mitigate risky rewrite directives where patches were not yet available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Calif researchers published an analysis of CVE-2026-42945 and CVE-2026-9256, built the open-source static scanner ngxray, and scanned 35,633 public GitHub NGINX configurations. After triage, they found only one genuinely vulnerable real-world configuration, suggesting low prevalence of exploitable public configs despite the severity of the bugs.
F5 published a product advisory for CVE-2026-9256 affecting the NGINX ngx_http_rewrite_module. Later analysis grouped this flaw with CVE-2026-42945 as one of two critical NGINX rewrite-engine RCE issues.
F5 published a product advisory for CVE-2026-8711 affecting the NGINX ngx_http_js_module.
CSIRT.SK stated that exploitation of CVE-2026-42945 was confirmed active as of May 18, 2026. The notice also said the flaw could cause denial of service and potentially remote code execution if ASLR is disabled.
CSIRT.SK reported that exploitation of CVE-2026-42945 began in the wild on May 17, 2026. The activity involved the critical rewrite-module flaw known as NGINX Rift.
F5 published a product advisory for CVE-2026-42934 affecting the NGINX ngx_http_charset_module.
F5 published a product advisory for CVE-2026-42926 affecting the NGINX ngx_http_proxy_v2_module.
F5 published a product advisory for CVE-2026-42945 affecting the NGINX ngx_http_rewrite_module. The flaw was later described as the 18-year-old 'NGINX Rift' vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
blog.calif.io
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourcecsirt.sk
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 and NGINX disclosed **CVE-2026-42945** ("**NGINX Rift**"), a critical heap buffer overflow in `ngx_http_rewrite_module` affecting **NGINX Open Source 0.6.27 through 1.30.0** and **NGINX Plus R32 through R36**. The bug is exposed when servers use a specific rewrite pattern: a `rewrite` directive with unnamed PCRE captures such as `$1` or `$2`, a replacement string containing `?`, and a following `rewrite`, `if`, or `set` directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where **ASLR is disabled**. Fixes were released in **NGINX 1.30.1**, **1.31.0**, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates. Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said **VulnCheck observed exploitation attempts on canary systems** within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including **CVE-2026-42946**, **CVE-2026-40701**, and **CVE-2026-42934**.
Jun 29, 2026
NGINX released versions **1.31.1** and **1.30.2** to fix **CVE-2026-9256**, a heap buffer overflow in `ngx_http_rewrite_module` that can be triggered by unauthenticated attackers with specially crafted HTTP requests. The flaw affects **NGINX Open Source** and **NGINX Plus** when `rewrite` directives use overlapping or nested PCRE capture groups and replacement strings that reference multiple captures in redirect or arguments contexts, creating memory corruption in the worker process. Successful exploitation can force worker restarts and denial of service, and may lead to arbitrary code execution if protections such as ASLR are absent or bypassed; NGINX described the issue as a **data plane** exposure with no control plane impact.
Jun 29, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026