CVE-2026-42945: F5 Nginx Open Source buffer overflow (CVSS 8.1)

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

F5 Dos4.8.0 · ≥ 4.3.0 ≤ 4.7.0

F5 Nginx Gateway Fabric≥ 1.3.0 ≤ 1.6.2 · ≥ 2.0.0 ≤ 2.5.1

F5 Nginx Ingress Controller≥ 3.5.0 ≤ 3.7.2 · ≥ 4.0.0 ≤ 4.0.1 · ≥ 5.0.0 ≤ 5.4.1

F5 Nginx Instance Manager≥ 2.16.0 ≤ 2.21.1

F5 Nginx Open Source≥ 0.6.27 ≤ 1.30.0

F5 Nginx Plus≥ r32 ≤ r36

F5 Waf≥ 4.9.0 ≤ 4.16.0 · ≥ 5.1.0 ≤ 5.8.0 · ≥ 5.9.0 ≤ 5.12.1

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://my.f5.com/manage/s/article/K000161019

References

and 24 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-42945 being actively exploited?

CVE-2026-42945 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 3.40%.

How severe is CVE-2026-42945?

CVE-2026-42945 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 3.40% probability of exploitation.

Which products are affected by CVE-2026-42945?

Affected products include F5 Dos, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Instance Manager, F5 Nginx Open Source, and 2 more.

How do I fix CVE-2026-42945?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-42945 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo