CVE-2026-42945: Heap-based Buffer Overflow in NGINX ngx_http_rewrite_module

Vulnerability ID: CVE-2026-42945

CVSS Score: 8.1

Published: 2026-05-13

A heap-based buffer overflow vulnerability exists in the NGINX ngx_http_rewrite_module due to an inconsistency in the two-pass script execution engine. Discovered by depthfirst, this flaw allows unauthenticated remote attackers to trigger memory corruption under specific configuration conditions, resulting in denial of service or remote code execution.

TL;DR

CVE-2026-42945 is a critical heap buffer overflow in NGINX's rewrite module.…