Buffer overflow and remote code execution affecting Nginx Open Source and Nginx Plus
A vulnerability affecting Nginx Open Source and Nginx Plus would allow an unauthenticated attacker to cause a denial of service (DoS) and remote arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
Nginx is a high-performance web server, reverse proxy and load balancer widely used for the distribution and security of web applications, available in community version (Nginx Open Source), as well as in commercial edition (Nginx Plus). This system is affected by a vulnerability labeled CVE-2026-42945 resulting from a heap buffer overflow within the ngx_http_rewrite_module component during the processing of certain rewrite directives. Exploitation of this vulnerability would allow an unauthenticated malicious actor to transmit specially crafted HTTP requests to cause a worker process to crash, and to execute arbitrary code remotely on systems where address space randomization (ASLR) is disabled. It is classified high with a severity score of 8.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Denial of Service (DoS);
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- NGINX Open Source versions 1.0.0 to 1.30.0;
- NGINX Open Source versions 0.6.27 to 0.9.7;
- NGINX Plus versions R32 to R36;
- NGINX Instance Manager versions 2.16.0 to 2.21.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update NGINX Open Source to its latest stable version;
- Update NGINX Plus to its latest stable version depending on the branch used;
- If unable to update immediately, apply the temporary mitigation measure (present in the first two references) and ensure that ASLR is enabled on all hosts running nginx;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.