New Nginx Exploit (github.com)

Article summary

A critical heap buffer overflow vulnerability, known as NGINX Rift, has been discovered in NGINX's ngx_http_rewrite_module, which can be exploited for unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-42945, was introduced in 2008 and affects servers using rewrite and set directives. A proof-of-concept exploit has been released, which uses cross-request heap feng shui and pool cleanup pointer corruption to achieve code execution. The vulnerability can be mitigated by updating NGINX to a patched version.

Main themes

• NGINX vulnerability
• Remote code execution
• Heap buffer overflow
• Exploit mitigation
• Server security
• ASLR bypass

What commenters say

• The NGINX Rift vulnerability is a significant threat, but its exploitation is unlikely due to the requirement of ASLR being disabled.
• The vulnerability can be exploited for unauthenticated remote code execution, making it a critical issue for servers using NGINX.
• The use of forked processes in NGINX makes it uniquely vulnerable to this type of exploit, as the same memory layout is used across worker processes.
• The exploit's reliance on ASLR being disabled is not a significant limitation, as the vulnerability can still be used to achieve a denial of service or potentially bypass ASLR.
• The comparison of NGINX's versioning scheme to other software, such as React, is arbitrary and not relevant to the security of the software.
• The vulnerability highlights the importance of keeping software up to date, as the patched version of NGINX mitigates the issue.
• The exploitation of the vulnerability requires a specific configuration, including a rewrite directive with a question mark in the replacement string and a subsequent set directive referencing a regex capture group.
• The claim that the vulnerability can be used to bypass ASLR is disputed, with some arguing that it is not a significant concern for modern Linux distributions.