Vulnerabilities & Exploits

Public PoC Turns NGINX Into Active Attack Surface

Public PoC publication has collapsed the patch window from days to hours. A recently fixed NGINX bug is already being hit in the wild, so this is no longer a disclosure you can defer to the next maintenance cycle. The edge tier is the target, and in some deployments a simple crash is enough to knock services over.

VulnCheck says it is seeing active exploitation of CVE-2026-42945 on canaries just days after the CVE was published and after Depthfirst released technical details and PoC code. The issue affects NGINX Open Source 0.6.27 through 1.30.0, NGINX Plus vR32 through R36, and F5 products that embed NGINX, including NGINX Ingress Controller and F5 WAF for NGINX.

The forward risk is broader than one vulnerable host. NGINX often sits in front of whole application stacks as a web server, reverse proxy, load balancer, or cache, so exploitation can become a control-plane problem for everything behind it. ASLR-disabled systems face code execution risk, and patching does not help any secrets or trust already exposed through the edge path.

4 sources · May 18

CVE-2026-42945

NVD KEV

CVSS 8.1 HIGH: nGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. Microsoft patch: CBL-Mariner Releases.

Timeline

Sources

May 18 Help Net Security
Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) - Help Net Security
A critical NGINX vulnerability (CVE-2026-42945) that was disclosed last week is being exploited by attackers, according to VulnCheck.
original
May 18 SecurityWeek
Exploitation of Critical NGINX Vulnerability Begins
The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled.
original
May 17 The Hacker News
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
CVE-2026-42945 is exploited after disclosure, impacting NGINX 0.6.27–1.30.0 and enabling crashes or RCE.
original

Vendor digest: F5

Part of the PlainSec briefing for 2026-05-16

Every edition of this story: Public PoC Turns NGINX Into Active Attack Surface

More from today

Vulnerabilities & ExploitsPublic PoC Turns NGINX Into Active Attack SurfacePublic PoC publication has collapsed the patch window from days to hours. A recently fixed NGINX bug is already being hit in the wild, so this is no longer a disclosure you can defer to the next maintenance cycle. The edge tier is the target, and in some deployments a simple crash is enough to knock services over.VulnCheck says it is seeing active exploitation of CVE-2026-42945 on canaries just days after the CVE was published and after Depthfirst released technical details and PoC code. The issue affects NGINX Open Source 0.6.27 through 1.30.0, NGINX Plus vR32 through R36, and F5 products that embed NGINX, including NGINX Ingress Controller and F5 WAF for NGINX.The forward risk is broader than one vulnerable host. NGINX often sits in front of whole application stacks as a web server, reverse proxy, load balancer, or cache, so exploitation can become a control-plane problem for everything behind it. ASLR-disabled systems face code execution risk, and patching does not help any secrets or trust already exposed through the edge path.4 sources · May 18

CVE-2026-42945

NVD KEV

CVSS 8.1 HIGH: nGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. Microsoft patch: CBL-Mariner Releases.

Timeline

May 18 Reported by Help Net Security

May 17 Reported by The Hacker News

May 14 Reported by BleepingComputer

Sources

May 18 Help Net Security

Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) - Help Net Security

A critical NGINX vulnerability (CVE-2026-42945) that was disclosed last week is being exploited by attackers, according to VulnCheck.

original

May 18 SecurityWeek

Exploitation of Critical NGINX Vulnerability Begins

The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled.

original

May 17 The Hacker News

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

CVE-2026-42945 is exploited after disclosure, impacting NGINX 0.6.27–1.30.0 and enabling crashes or RCE.

original

Vendor digest: F5Part of the PlainSec briefing for 2026-05-16Every edition of this story: Public PoC Turns NGINX Into Active Attack SurfaceMore from today

Stray PHPUnit Test Files Keep Exposing Production Servers

Checkout Plugin Settings Turn WordPress Stores Into Skimmers

Metasploit Modules Turn Old CVEs Into Routine Targets