New Nginx Exploit

A critical, 18-year-old heap buffer overflow vulnerability (CVE-2026-42945) in Nginx's ngx_http_rewrite_module has been revealed, enabling unauthenticated remote code execution. The bug, stemming from a two-pass script engine error, highlights the fragility of widely used, long-standing software. Its autonomous discovery by an AI security tool adds another layer of intrigue to this urgent security alert.

Score

Comments

Highest Rank

19h

on Front Page

First Seen

May 14, 5:00 PM

Last Seen

May 15, 11:00 AM

Rank Over Time

The Lowdown

A severe heap buffer overflow, tracked as CVE-2026-42945 and dubbed "Nginx Rift," has been publicly disclosed, threatening millions of Nginx installations worldwide. This critical vulnerability, present since Nginx version 0.6.27 in 2008, allows unauthenticated remote code execution under specific, common configurations.

Vulnerability Type: Heap buffer overflow in Nginx's ngx_http_rewrite_module.
Root Cause: A discrepancy between two passes of Nginx's script engine. The length-calculation pass incorrectly assumes is_args = 0, while the subsequent copy pass correctly processes is_args = 1, leading to ngx_escape_uri expanding bytes and overflowing an undersized buffer.
Preconditions: Exploitation requires the use of a rewrite directive with a ? in the replacement string and a subsequent set directive referencing a regex capture group (e.g., $1).
Exploitation Method: The proof-of-concept (PoC) leverages cross-request heap feng shui to corrupt an adjacent ngx_pool_t's cleanup pointer, redirecting it to a fake structure that invokes system() on pool destruction.
Discovery: The vulnerability, along with three other memory corruption issues, was autonomously identified by DepthFirst's AI security analysis system after a single click of onboarding the Nginx source code.
Affected Versions: NGINX Open Source versions 0.6.27 through 1.30.0 are vulnerable, with fixes available in 1.31.0 and 1.30.1. NGINX Plus R32 through R36 are also affected.
Mitigation: Vendors advise using named captures instead of unnamed captures in rewrite definitions to prevent triggering the bug.

This disclosure emphasizes the enduring presence of critical vulnerabilities in foundational software and the evolving role of AI in uncovering them. Users are urged to patch immediately or implement the suggested mitigation.

The Gossip

ASLR Assumptions and Attack Realities

A significant portion of the discussion centered on the exploitability of the vulnerability, particularly concerning Address Space Layout Randomization (ASLR). While some initially downplayed the threat, pointing out that the published PoC disables ASLR, others vehemently argued that ASLR is a defense-in-depth mechanism, not a silver bullet. These commenters stressed that skilled attackers will almost certainly develop ASLR bypasses, making the vulnerability a serious concern regardless of its presence in the PoC. They urged immediate patching, emphasizing the danger of falsely believing mitigations render vulnerabilities harmless.

Config Conundrums and Broad Compromise

Commenters debated the practical impact of the vulnerability, specifically how common the prerequisite Nginx configurations (`rewrite` with `?` and `set` directives) are in real-world deployments. Many concluded that these patterns are extremely prevalent, especially in Nginx's role as a reverse proxy or load balancer, significantly widening the attack surface. The official mitigation recommendation of switching to named captures was also discussed as a temporary measure until patches can be applied.

Versioning Vexations and Software Longevity

A tangent emerged regarding Nginx's versioning scheme, comparing its stable 1.x version to the rapid iteration of modern software like React. This sparked a discussion on "finished software" philosophies versus continuous development. Most contributors clarified that Nginx's versioning is arbitrary and reflects its mature, stable design with a focus on backward compatibility, rather than a lack of ongoing development or progress.