Loading story…
NGINX released versions 1.31.1 and 1.30.2 to fix CVE-2026-9256, a heap buffer overflow in ngx_http_rewrite_module that can be triggered by unauthenticated attackers with specially crafted HTTP requests. The flaw affects NGINX Open Source and NGINX Plus when rewrite directives use overlapping or nested PCRE capture groups and replacement strings that reference multiple captures in redirect or arguments contexts, creating memory corruption in the worker process. Successful exploitation can force worker restarts and denial of service, and may lead to arbitrary code execution if protections such as ASLR are absent or bypassed; NGINX described the issue as a data plane exposure with no control plane impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers published an analysis of CVE-2026-9256 and CVE-2026-42945 using an open-source static scanner called ngxray to measure exposure in public GitHub nginx configurations. Their scan of 35,633 parseable configs found mostly proofs of concept and test cases, with one publicly available real configuration identified as vulnerable.
NGINX disclosed a buffer overflow vulnerability in ngx_http_rewrite_module, tracked as CVE-2026-9256, affecting NGINX Plus and NGINX Open Source when overlapping PCRE captures are used in certain rewrite directives. The issue was fixed in releases 1.31.1 and 1.30.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 and NGINX disclosed **CVE-2026-42945** ("**NGINX Rift**"), a critical heap buffer overflow in `ngx_http_rewrite_module` affecting **NGINX Open Source 0.6.27 through 1.30.0** and **NGINX Plus R32 through R36**. The bug is exposed when servers use a specific rewrite pattern: a `rewrite` directive with unnamed PCRE captures such as `$1` or `$2`, a replacement string containing `?`, and a following `rewrite`, `if`, or `set` directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where **ASLR is disabled**. Fixes were released in **NGINX 1.30.1**, **1.31.0**, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates. Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said **VulnCheck observed exploitation attempts on canary systems** within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including **CVE-2026-42946**, **CVE-2026-40701**, and **CVE-2026-42934**.
Jun 29, 2026
Researchers disclosed **CVE-2026-27654**, a heap buffer overflow in NGINX's `ngx_http_dav_copy_move_handler()` that affects deployments compiled with `ngx_http_dav_module` and configured with `alias` alongside WebDAV `COPY` or `MOVE` methods. The bug stems from an unsigned underflow in `ngx_http_map_uri_to_path()` when a `Destination` header is shorter than the location prefix, allowing WebDAV root escape and arbitrary file read or write within the worker process's filesystem permissions. Calif.io said it developed multiple proof-of-concept exploits with AI assistance, including variants that could copy sensitive files such as `/etc/passwd` into attacker-accessible locations and write files through `PUT` and `COPY`, while noting that human researchers were needed to turn the initial AI-generated crash into a practical exploit chain. F5 and the NGINX security team were notified in March and released a fix in **NGINX 1.29.7** with advisory `K000160382`, while Calif later published PoC materials on GitHub describing the work as AI-generated and human-verified. Separately, Nebula Security reported a distinct NGINX zero-day dubbed **nginx-poolslip**, describing remote code execution in dynamic variable parsing paths affecting **NGINX 1.31.0** and claiming its autonomous AI agent discovered the flaw; the report said technical details were initially withheld during disclosure and that **NGINX 1.31.1** was later released as the patch. Together, the disclosures underscore a rapid cycle in which AI-assisted research is producing crash reproduction, exploit development, and fresh vulnerability claims against widely deployed NGINX code.
Jun 29, 2026
German government CERT advisories report multiple vulnerabilities in **NGINX** and **NGINX Plus** that can be exploited for **denial of service**, with a newer notice warning that affected **NGINX Open Source** and **NGINX Plus** deployments may also face **potential code execution**. The advisories indicate that the issues affect both the commercial and open source product lines, expanding the risk beyond service disruption alone. The earlier advisory described multiple flaws enabling service outages in NGINX and NGINX Plus, while the later advisory escalated the impact to include possible remote code execution in addition to denial of service. Organizations running internet-facing NGINX infrastructure should review the referenced dCERT notices, identify exposed versions across reverse proxies, load balancers, and web servers, and prioritize vendor-recommended updates or mitigations.
Jun 29, 2026