NGINX Rift (CVE-2026-42945): 18-Year-Old Critical Flaw Now Being Exploited

A critical security vulnerability in NGINX has come under active exploitation just days after its public disclosure, marking one of the most significant web infrastructure threats of 2026. The flaw, tracked as CVE-2026-42945 and nicknamed NGINX Rift, carries a CVSS v4 score of 9.2 and affects NGINX versions 0.6.27 through 1.30.0. It resides in the ngx_http_rewrite_module, a component introduced in 2008 and present in virtually every standard NGINX build since. The vulnerability went undetected by human reviewers for 18 years before being identified by an autonomous AI-powered analysis system developed by security research firm depthfirst.

What the flaw does

CVE-2026-42945 is a heap buffer overflow triggered when NGINX processes specially crafted HTTP requests under specific rewrite configurations. An unauthenticated remote attacker can exploit the flaw to crash NGINX worker processes, a denial-of-service condition that is exploitable without any preconditions. On systems where Address Space Layout Randomisation (ASLR) has been disabled, the vulnerability may additionally enable full remote code execution. Like the Cisco SD-WAN CVSS 10.0 exploit that landed on the CISA KEV list this month, NGINX Rift demands the same level of urgency from enterprise security teams. NGINX powers approximately 34% of all websites globally and serves as the reverse proxy layer in a significant proportion of enterprise Kubernetes environments. For organisations using rewrite rules with unnamed PCRE capture expressions, a common configuration in production deployments across the GCC and wider region, the exposure is immediate. Security researcher Kevin Beaumont offered a measured but clear assessment of the risk:

"It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it. To reach RCE, ASLR also needs to have been disabled on the box."

AlmaLinux maintainers echoed this, noting that turning the heap overflow into reliable code execution is not trivial in the default configuration, but adding plainly:

"That said, 'not easy' is not 'impossible', and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent."

Exploitation already under way

Threat intelligence firm VulnCheck confirmed that exploitation attempts have been detected against its honeypot infrastructure. The nature of the attacks and their end objectives are not yet confirmed, but the speed of weaponisation within days of the public disclosure on 13 May 2026 is consistent with the pattern observed for high-CVSS vulnerabilities with publicly available proof-of-concept code. A public proof-of-concept exploit for CVE-2026-42945 is now available on GitHub, placing the barrier for entry well within reach of opportunistic actors, not only sophisticated threat groups.

Additional NGINX vulnerabilities disclosed alongside

The depthfirst disclosure surfaced three further vulnerabilities in the same audit. CVE-2026-42946 (CVSS 8.3) enables excessive memory allocation in the ngx_http_scgi_module and ngx_http_uwsgi_module modules, allowing an unauthenticated attacker in a man-in-the-middle position to read worker process memory. CVE-2026-40701 (CVSS 6.3) is a use-after-free in the SSL module. CVE-2026-42934 (CVSS 6.3) is an out-of-bounds read in the charset module. All four were patched in the same release cycle.

What to do now

F5 has released patches for NGINX Plus and NGINX Open Source. Organisations running any NGINX version between 0.6.27 and 1.30.0 should apply the latest update immediately. Teams managing cloud-hosted or containerised deployments should verify their images are rebuilt against a patched base. Confirming ASLR is enabled on all production servers running NGINX is an additional hardening step that costs nothing and substantially raises the bar for any attacker attempting code execution. For GCC enterprise security teams reviewing infrastructure posture, particularly those managing internet-facing load balancers and API gateways, this vulnerability warrants emergency change-window priority this week. The CISA Known Exploited Vulnerabilities catalogue and F5 security advisories should be monitored for any further guidance. Security teams looking to strengthen their broader vulnerability management posture can also refer to MENA Cyber Wire's threat intelligence coverage for ongoing analysis of actively exploited CVEs across the region. The identity and access management challenges facing GCC enterprises also intersect directly with the risk of unpatched server infrastructure being used as a foothold for credential harvesting.