CVE-2026-42945

The vulnerability manifests when a rewrite directive is preceded by another rewrite, if, or set directive, and the PCRE regular expression contains an unnamed capture (e.g., $1, $2) in combination with a replacement string containing a question mark (?). An unauthenticated attacker can send crafted HTTP requests that trigger a heap buffer overflow in the NGINX worker process. Successful exploitation of the vulnerability requires certain conditions to be met that are partially independent of the attacker, which reflects a high level of attack complexity (AC:H in the CVSS vector).

In a typical attack scenario, an attacker can cause an NGINX worker process restart, resulting in temporary service unavailability. On systems with ASLR disabled or after bypassing it, remote code execution (RCE) is possible in the context of the NGINX worker process.

Patches available from the vendor should be applied in accordance with the references (F5 article K000161019: https://my.f5.com/manage/s/article/K000161019). As an additional remedial measure, it is recommended to ensure that the ASLR mechanism is enabled on servers hosting NGINX, which significantly complicates effective code execution by an attacker.

NGINX Plus and NGINX Open Source — specific versions indicated in the vendor references (F5 article K000161019). Versions that have reached end of technical support (EoTS) are not subject to this assessment.