NGINX Rift Rewrite Flaw Triggers Worker Crashes and Possible RCE

F5 and NGINX disclosed CVE-2026-42945 ("NGINX Rift"), a critical heap buffer overflow in ngx_http_rewrite_module affecting NGINX Open Source 0.6.27 through 1.30.0 and NGINX Plus R32 through R36. The bug is exposed when servers use a specific rewrite pattern: a rewrite directive with unnamed PCRE captures such as $1 or $2, a replacement string containing ?, and a following rewrite, if, or set directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where ASLR is disabled. Fixes were released in NGINX 1.30.1, 1.31.0, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates.

Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said VulnCheck observed exploitation attempts on canary systems within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including CVE-2026-42946, CVE-2026-40701, and CVE-2026-42934.