CVE-2026-42945 (CVSS 9.2): NGINX Rift Heap Overflow Exploited in the Wild — Unauthenticated RCE PoC Now Public

CVE-2026-42945 — dubbed “NGINX Rift” — is a heap buffer overflow in ngx_http_rewrite_module that has existed in NGINX since version 0.6.27, roughly 18 years of undetected surface. Every stable NGINX release through 1.30.0 is affected. CVSS 9.2.

F5 disclosed the vulnerability on May 13, 2026. Three days later, Cloudflare’s threat intelligence team detected exploitation attempts in the wild. As of May 27, a public proof-of-concept includes a full ASLR-bypass chain that enables unauthenticated remote code execution — no need to disable ASLR, no prior authentication, no interaction from the target server operator.

What the vulnerability allows

The ngx_http_rewrite_module processes Lua-style rewrite rules in NGINX config. A crafted HTTP request can overflow a heap buffer during rewrite evaluation, corrupting adjacent memory. The public PoC leverages an information leak in a secondary NGINX worker process to defeat ASLR, then overwrites a function pointer to redirect execution. End result: arbitrary code execution as the NGINX worker process user — typically www-data or nginx.

On servers where NGINX runs as root (a misconfiguration, but a common one), the attacker gets root-level RCE with no authentication. Even on hardened deployments running NGINX as a low-privilege user, attackers can pivot using stolen secrets from memory, spawn reverse shells, or move laterally within a containerized environment.

Affected versions

• All releases: 0.6.27 — 1.30.0 (stable and mainline branches)
• NGINX Plus R32 and earlier (commercial) — F5 advisory separately covers patch versions
• Kubernetes ingress-nginx is affected if it ships NGINX 1.30.0 or earlier — HeroDevs confirmed the ingress controller is exposed

Patches available

• NGINX 1.30.1 (stable) — patched
• NGINX 1.31.0 (mainline) — patched
• NGINX Plus R33 — patched

Upgrade command for Debian/Ubuntu:

apt update && apt install nginx=1.30.1-1~focal

For Alpine (common in Docker images):

apk upgrade nginx

Verify your version:

nginx -v

Mitigations if you cannot patch immediately

Disabling the ngx_http_rewrite_module removes the attack surface but breaks any site using rewrite rules, which is most production deployments. A more practical temporary control: restrict HTTP request sizes and apply a WAF rule blocking malformed rewrite-targeting payloads. F5 published specific WAF signatures within 48 hours of disclosure.

Why this took 18 years

The vulnerable code path required a specific combination of rewrite rule depth and allocator state that fuzzing at shallow depths consistently missed. The researcher who found it, Jonah Schultz at Assetnote, was running a deep-state allocator fuzzer targeting rarely exercised code paths in memory-unsafe C modules. The same technique has already surfaced two additional bugs in NGINX now under responsible disclosure.

If you run NGINX anywhere — directly, behind a CDN, inside a Docker container, as an ingress controller — patch today. The PoC is public and exploitation has been confirmed.