CVE-2026-42945NGINX Open Source Heap Buffer Overflow
nginx: NGINX: Arbitrary Code Execution Vulnerability
Published May 15, 2026 · Updated Oct 24, 2026 · Also known as ALPINE-CVE-2026-42945, BIT-nginx-2026-42945, BIT-nginx-gateway-2026-42945, DEBIAN-CVE-2026-42945, ROOT-OS-ALPINE-315-CVE-2026-42945, ROOT-OS-ALPINE-320-CVE-2026-42945, TR-26-0241, UBUNTU-CVE-2026-42945, USN-8271-1
Key Facts
Patch immediately- CVE-2026-42945 is a critical-severity vulnerability (CVSS 9.2 v4) affecting Dos (F5), Nginx App Protect Dos (F5), Nginx App Protect Waf (F5) and 22 more products.
- It is exploited in the wild, listed in Industry KEV feed since May 16, 2026. No public exploit code is known.
- EPSS estimates a 68% probability of exploitation in the next 30 days.
- Fixed versions are available, including Dos 4.7.0, Nginx App Protect Dos 4.7.0, Nginx App Protect Waf 4.16.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
68%
Higher than 99.3% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
64/100
Publication score, see How it works
Exploitation Verdict
KEV listed
May 16, 2026
1 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Advisories And Exploit References
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests.
This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | May 16, 2026 | n/a | Not reported |
Affected Products
336 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DosF5 | 4.8.0 | 4.7.0 |
| Nginx App Protect DosF5 | See advisory | 4.7.0 |
| Nginx App Protect WafF5 | See advisory | 4.16.0 |
| Nginx Gateway FabricF5 | See advisory | 1.6.2 |
| Nginx Ingress ControllerF5 | See advisory | 3.7.2 |
Patched Releases
Dos
4.7.0
Nginx App Protect Dos
4.7.0
Nginx App Protect Waf
4.16.0
Nginx Gateway Fabric
1.6.2
Nginx Ingress Controller
3.7.2
Nginx Instance Manager
2.21.1
NGINX Open Source
1.30.0, 1.30.1
NGINX Plus
r36, R32 P6, R36 P4
Waf
5.12.1
ingress-nginx-controller-1.13
1.13.9-r9
ingress-nginx-controller-1.14
1.14.5-r12
ingress-nginx-controller-1.15
1.15.5-r1
ingress-nginx-controller-fips-1.13
1.13.9-r9
ingress-nginx-controller-fips-1.14
1.14.5-r9
ingress-nginx-controller-fips-1.15
1.15.5-r1
libnginx-mod-http-auth-pam
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-cache-purge
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-dav-ext
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-echo
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-fancyindex
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-geoip
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11, 1.24.0-2ubuntu7.8, 1.28.0-6ubuntu1.3, 1.28.3-2ubuntu1.1
libnginx-mod-http-geoip2
1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-headers-more-filter
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11
libnginx-mod-http-image-filter
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.11, 1.24.0-2ubuntu7.8, 1.28.0-6ubuntu1.3, 1.28.3-2ubuntu1.1
libnginx-mod-http-lua
1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1
Timeline
Publicly disclosed
May 15, 2026
Added to Industry KEV feed
May 16, 2026
Last updated
Oct 24, 2026
Weakness Type
- CWE-122 Heap-based Buffer Overflow
- CWE-131 Incorrect Calculation of Buffer Size
References
- advisorysecurity.alpinelinux.org · CVE-2026-42945
- advisorysecurity-tracker.debian.org · CVE-2026-42945
- advisoryubuntu.com · CVE-2026-42945
- advisorycve.org · CVERecord
- advisoryRHSA-2026:17417
FAQ
Common Questions.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.
Affected: Dos (F5) versions 4.8.0; Nginx App Protect Dos (F5); Nginx App Protect Waf (F5), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since May 16, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Dos 4.7.0, Nginx App Protect Dos 4.7.0, Nginx App Protect Waf 4.16.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-42945 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo