8.1
High
CVE-2026-42945 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Plus | Versions not published | |
| NGINX Open Source 1.31 | earliest → < 1.31.0 | 1.31.0 |
| NGINX Open Source 0.6 | 0.6.27 → < 1.30.1 | 1.30.1 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Versions not published |
Show the 30 other branches Hide the 30 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Versions not published | |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Versions not published | |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Versions not published | |
| Red Hat Hardened Images 1.30 | earliest → < 1.30.1-1.hum1 | 1.30.1-1.hum1 |
| Red Hat Openshift Data Foundation 4.14 1779972179 | earliest → < 1779972179 | 1779972179 |
| Red Hat Openshift Data Foundation 4.15 1779968303 | earliest → < 1779968303 | 1779968303 |
| Red Hat Openshift Data Foundation 4.16 1779959592 | earliest → < 1779959592 | 1779959592 |
| Red Hat Openshift Data Foundation 4.17 1779952463 | earliest → < 1779952463 | 1779952463 |
| Red Hat Openshift Data Foundation 4.18 1779881122 | earliest → < 1779881122 | 1779881122 |
| Red Hat Openshift Data Foundation 4.19 1779881332 | earliest → < 1779881332 | 1779881332 |
| Red Hat Openshift Data Foundation 4.21 1779946691 | earliest → < 1779946691 | 1779946691 |
| Red Hat Openshift Data Foundation 4.2 1779881377 | earliest → < 1779881377 | 1779881377 |
| Red Hat Satellite 6.18 1779706745 | earliest → < 1779706745 | 1779706745 |
| Red Hat Satellite 6.19 1779706797 | earliest → < 1779706797 | 1779706797 |
| Red Hat Update Infrastructure 5 1787241260 | earliest → < 1787241260 | 1787241260 |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Lightspeed proxy 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260514165201.489197 | earliest → < 8100020260514165201.489197e6 | 8100020260514165201.489197e6 |
| Red Hat Enterprise Linux 9 9080020260514152324.9 | earliest → < 9080020260514152324.9 | 9080020260514152324.9 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.4 Extended Update Support 9040020260514192210.9 | earliest → < 9040020260514192210.9 | 9040020260514192210.9 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Openshift Data Foundation 4.20 1779881377 | earliest → < 1779881377 | 1779881377 |
References
- my.f5.com my.f5.com
Timeline
- Published
- Last modified
Other CVEs of NGINX Plus
The 37 CVEs of NGINX Plus →
CVE-2026-95101
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module
5.3
Medium
CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root…
8.1
High
CVE-2026-97205
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module
8.1
High
CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive…
8.1
High