NGINX RCE Alert: CVE-2026-42945 Actively Exploited via Rewrite Module

Hey team,

Just caught the latest from VulnCheck regarding CVE-2026-42945. This one is nasty—it's a heap buffer overflow in the ngx_http_rewrite_module and it is already under active exploitation in the wild.

The vulnerability impacts a vast range of versions, from 0.6.27 through 1.30.0. If you are running anything in that window, you are exposed. With a CVSS score of 9.2, this is critical. While the immediate impact often results in worker process crashes (DoS), researchers at depthfirst have confirmed the potential for Remote Code Execution (RCE).

The flaw is triggered by specifically crafted requests that interact with the rewrite logic. Since rewrite rules are fundamental to almost every NGINX config, the attack surface here is significant.

First step: Verify your version immediately.

nginx -v 2>&1


If you are stuck on an older version and can't upgrade immediately, you need to be hunting for signs of compromise. Check for abnormal worker process exits or restarts in your system logs.

journalctl -u nginx -n 200 | grep -E "worker process.*exited|restarting"


If you detect crashes, correlate them with your access logs to find the triggering request. I'd recommend temporarily disabling complex regex rewrites if they aren't mission-critical until you can patch.

Given the speed of the active exploitation, I'm curious how everyone is handling the rollback window? Are you just hot-patching or spinning up fresh nodes?