Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
F5 NGINX Plus — NGINX ngx_http_rewrite_module vulnerability
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N H N N N H H H 9.2 .6604 99.2 —
AFFECTED
Product Versions Fixed
NGINX Plus R36 – R37
NGINX Open Source 0.6.27 – 1.31.0
TIMELINE
Apr 30 Reserved by f5
May 13 Published (CNA: f5)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-42945 (F5 NGINX Plus). Public exploit reference added.
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| April 30, 2026 | Reserved | Reserved by f5 |
| May 13, 2026 | Published | Published (CNA: f5) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-42945 (F5 NGINX Plus). Public exploit reference added. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| F5 | NGINX Plus | — | R36 | R37 |
| F5 | NGINX Open Source | — | 0.6.27 | 1.31.0 |
References (33)
- https://access.redhat.com/errata/RHSA-2026:17417 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17751 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17752 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17753 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17790 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17791 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17792 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17793 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17794 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18029 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18041 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:18063 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:19159 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:19371 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:19372 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:19374 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:20442 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:20444 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:21275 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22382 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22383 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22388 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22389 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22390 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22393 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22394 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22396 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/security/cve/CVE-2026-42945 [vdb-entry, x_refsource_REDHAT]
- https://bugzilla.redhat.com/show_bug.cgi?id=2477116 [issue-tracking, x_refsource_REDHAT]
- https://depthfirst.com/nginx-rift
- https://github.com/DepthFirstDisclosures/Nginx-Rift
- https://my.f5.com/manage/s/article/K000161019 [vendor-advisory, patch]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json [x_sadp-csaf-vex]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42945 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.