NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

"The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0. Successful exploitation of the flaw can permit an unauthenticated attacker to crash worker processes or execute remote code with crafted HTTP requests. However, it bears noting that code execution is possible only on devices where Address Space Layout Randomization (ASLR), a safeguard against memory-based attacks, is turned off."

""It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it," security researcher Kevin Beaumont said. "To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.""

""Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce." The maintainers added: "That said, 'not easy' is not 'impossible,' and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent," the maintainers added."

"The latest findings from VulnCheck show that threat actors have begun to weaponize the flaw, with exploitation attempts detected against its honeypot networks. The nature of the attack activity and the end goals are presently unknown. Users are advised to apply the latest fixes from F5 to secure their networks against active threats."

CVE-2026-42945 is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0, with a CVSS score of 9.2. The flaw was introduced in 2008. Crafted HTTP requests can allow an unauthenticated attacker to crash NGINX worker processes or potentially execute remote code. Remote code execution requires a specific NGINX configuration that makes the vulnerability reachable and requires Address Space Layout Randomization to be disabled. Default configurations with ASLR enabled make reliable code execution difficult, but worker-crash denial of service remains exploitable. VulnCheck observed exploitation attempts in the wild shortly after disclosure, including activity against honeypot networks. Users are advised to apply the latest fixes from F5 urgently.

Read at The Hacker News