NGINX Rewrite Rules Expose Workers to Crafted Requests
The real exposure is not the web server in general. It is the request parser path behind specific rewrite rules, so some NGINX deployments are exposed to unauthenticated crash or code execution attempts even when the front end looks hardened.
F5 and independent researchers identified CVE-2026-42945 in ngx_http_rewrite_module, a heap buffer overflow with a CVSS 9.2 score. It affects NGINX Plus and NGINX Open Source when a rewrite, if, or set directive is paired with an unnamed PCRE capture and a replacement string containing a question mark; fixed versions are published for supported releases.
The risk is configuration-dependent, not universal. Some setups can reduce exposure by changing rewrite patterns, but any affected worker process can still be crashed, and systems with ASLR disabled face code execution risk until patched.