F5 WAF for NGINX

CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in rewrite module ("NGINX Rift"), PoC public

CVE-2026-42945 (CVSS 4.0: 9.2, codename "NGINX Rift") is a heap buffer overflow present in src/http/ngx_http_script.c since NGINX 0.6.27 (2008) (depthfirst "NGINX Rift" technical writeup, 2026-05-13 · NCSC-CH Security Hub #12575, 2026-05-15). The root cause: when a rewrite directive combines an unnamed PCRE capture ($1, $2) with a replacement string containing ?, followed by another rewrite, if, or set directive in the same scope, ngx_http_script_start_args_code() sets a flag causing the write phase to URI-encode URI argument characters (expanding +, %, and & by two bytes each) while the length-calculation phase computed a shorter buffer without this escaping. The result is a deterministic out-of-bounds write into the adjacent heap allocation. Reliable impact is crash of the NGINX worker process (DoS with automatic master restart); RCE requires ASLR to be disabled on the host. A working PoC is public at github.com/depthfirstdisclosures/nginx-rift. depthfirst's internal analysis system found the flaw on 2026-04-18; depthfirst reported it to NGINX on 2026-04-21, shared its RCE proof of concept on 2026-05-05, and F5 released the advisory on 2026-05-13 (depthfirst, 2026-05-13). NCSC-CH rated the exploitation status "UNKNOWN, Proof of Concept Available" on 2026-05-15 (NCSC-CH Security Hub #12575, 2026-05-15); VulnCheck's honeypot reports followed two days later (below). Temporary workaround: replace all unnamed captures with named captures (e.g., (?<user_id>...) → $user_id) in rewrite directives, which eliminates the vulnerable code path without requiring upgrade. Affected: NGINX Open Source 0.6.27 to 1.30.0 (nginx.org); NGINX Plus R32 to R36; Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1 and 5.0.0 to 5.4.1; Gateway Fabric 1.3.0 to 1.6.2 and 2.0.0 to 2.5.1; Instance Manager 2.16.0 to 2.21.1; F5 WAF for NGINX 5.9.0 to 5.12.1; App Protect WAF 4.9.0 to 4.16.0 and 5.1.0 to 5.8.0; F5 DoS for NGINX 4.8.0; App Protect DoS 4.3.0 to 4.7.0 (Security Affairs, 2026-05). Fixed: NGINX Open Source 1.30.1 and 1.31.0 (nginx.org); NGINX Plus R32 P6 and R36 P4 (Security Affairs, 2026-05).

VulnCheck reported exploitation attempts against its honeypot networks; the nature of the activity and its goals are unknown (The Hacker News, 2026-05-17).

Contradiction: the NGINX project rates the flaw severity medium (nginx.org), while NCSC-CH gives a CVSS 4.0 score of 9.2 (NCSC-CH Security Hub #12575, 2026-05-15) and depthfirst rates it critical at 9.2 (depthfirst, 2026-05-13); the gap likely reflects the preconditions, a specific rewrite pattern and, for code execution, ASLR disabled.

Builds on: SAP's August patch day is led by a CVSS 10.0 pre-auth code-execution flaw in the Commerce Cloud…