PoC Code Published for Critical NGINX Vulnerability
Technical details and proof-of-concept (PoC) exploit code targeting a newly patched critical-severity vulnerability in NGINX are now available.
Tracked as CVE-2026-42945 (CVSS score of 9.2), the issue was patched in the widely used web server this week as part of F5’s latest quarterly patch release, 16 years after it was introduced.
The bug is described as a heap buffer overflow in the ngx_http_rewrite_module component that could be exploited to trigger a restart, creating a denial-of-service (DoS) condition.
Remote code execution (RCE) is also possible if Address Space Layout Randomization (ASLR) is disabled, F5 warned.
According to Depthfirst, CVE-2026-42945 impacts NGINX servers using rewrite and set directives and is rooted in the use of a two-pass process in the script engine: one to compute the required buffer size, and the other to copy data.
Because the internal engine state changes between the two passes, if a rewrite replacement that...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
