Loading story…
Research by Alex Brumen identified cache key injection, a web-cache poisoning weakness in Nginx deployments that construct cache keys by ambiguously concatenating attacker-controlled request components without separators. Different requests can collide on the same cache key, allowing attackers to obtain previously cached access-restricted responses, poison legitimate pages with error responses for denial of service, and potentially inject persistent cross-site scripting through HTTP/HTTPS scheme and Host-header confusion.
The exposure can extend to sites using Cloudflare in front of an Nginx origin cache: an Authorization header can bypass Cloudflare’s edge cache while the origin still caches the resulting response. Organizations should use delimiters or structured encoding for cache-key fields, prohibit shared caching of authenticated or protected responses, strictly validate Host headers, enforce HTTP-to-HTTPS redirects, and ensure CDN and origin-cache policies are aligned.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Alex Brumen's research described cache key injection, in which ambiguously concatenated attacker-influenced request components in Nginx cache keys allow distinct requests to collide. The demonstrated impacts include exposure of cached restricted content, cache-poisoned denial of service, and potential stored cross-site scripting through HTTP/HTTPS scheme and Host-header confusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NGINX released versions **1.31.1** and **1.30.2** to fix **CVE-2026-9256**, a heap buffer overflow in `ngx_http_rewrite_module` that can be triggered by unauthenticated attackers with specially crafted HTTP requests. The flaw affects **NGINX Open Source** and **NGINX Plus** when `rewrite` directives use overlapping or nested PCRE capture groups and replacement strings that reference multiple captures in redirect or arguments contexts, creating memory corruption in the worker process. Successful exploitation can force worker restarts and denial of service, and may lead to arbitrary code execution if protections such as ASLR are absent or bypassed; NGINX described the issue as a **data plane** exposure with no control plane impact.
Jun 29, 2026
F5 disclosed multiple NGINX vulnerabilities across modules, with the most serious issues centered on the `ngx_http_rewrite_module`, including **CVE-2026-42945** and **CVE-2026-9256**. The flaw dubbed **NGINX Rift** is a long-standing heap buffer overflow in the rewrite engine that can be triggered remotely through crafted HTTP requests, leading to worker crashes, repeated restarts, and denial of service; under some conditions, including disabled ASLR, remote code execution is possible. CSIRT.SK reported active exploitation of **CVE-2026-42945** and said the bug affects both NGINX Open Source and F5/NGINX-related products, while F5 also published advisories for additional bugs in `ngx_http_proxy_v2_module`, `ngx_http_charset_module`, and `ngx_http_js_module`. Independent analysis of the two rewrite-engine RCE bugs found that exploitation depends on specific rewrite patterns involving `rewrite`, `if`, `set`, positional captures, and question-mark handling in PCRE-based rules. Researchers behind the **ngxray** scanner reviewed 35,633 public NGINX configurations from GitHub and found only one confirmed real-world vulnerable configuration after triage, suggesting the bugs are severe but uncommon in exposed public configs. Defenders were urged to upgrade to fixed releases, including **NGINX Open Source 1.30.1 or 1.31.0** and **NGINX Plus R32 P6 or R36 P4**, and to review or mitigate risky rewrite directives where patches were not yet available.
Jul 30, 2026
Researchers and bug bounty hunters have demonstrated advanced techniques for exploiting web cache poisoning vulnerabilities in web applications. These attacks leverage inconsistencies in how web servers and caching layers handle HTTP requests, particularly when parameters are excluded from cache keys or when GET requests with bodies are accepted. By manipulating request parameters and exploiting these discrepancies, attackers can poison cached responses, leading to the execution of arbitrary JavaScript in victim browsers and potential data leaks. Specific labs and real-world scenarios illustrate how features intended for performance optimization, such as parameter cloaking and accepting non-standard HTTP requests, can inadvertently introduce critical security flaws. Tools like Burp Suite's Param Miner assist in identifying these vulnerabilities, and the research underscores the importance of understanding HTTP protocol intricacies for both attackers and defenders. The findings highlight the need for rigorous cache key management and consistent parameter parsing to prevent exploitation.
Jun 29, 2026