NGINX Rift (CVE-2026-42945) — what hosting operators need to do

CVE-2026-42945, nicknamed NGINX Rift, is a critical heap-based buffer overflow in ngx_http_rewrite_module — the module compiled into every standard NGINX build. It is unauthenticated, reachable over plain HTTP, and lets an attacker either crash worker processes or achieve remote code execution. The flaw has been in the tree since 0.6.27, which makes it roughly 18 years old.

CVSS is 9.2 (Critical). If you run NGINX as a reverse proxy in front of cPanel or Plesk, as a LiteSpeed alternative, or as the front door for an ingress controller, you're in scope.

Affected versions

NGINX Open Source: 0.6.27 through 1.30.0
NGINX Plus: R32 through R36
F5/NGINX adjacent: NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect (WAF and DoS), NGINX Gateway Fabric, NGINX Ingress Controller

The vulnerability is in the data plane only — the control plane (API, dashboards) is not exposed by this bug.

Patched versions

Product	Fixed in
NGINX Open Source	1.31.0 (mainline) or 1.30.1 (stable)
NGINX Plus R36	P4
NGINX Plus R32	P6

Upgrade is the right answer. The patch is a buffer-sizing fix in src/http/ngx_http_script.c and ships clean — no config changes required.

Why it triggers

The buffer for a rewritten URI is sized using one set of escaping assumptions and then written using another. When all three conditions line up, the write overruns:

A rewrite directive uses unnamed regex captures ($1, $2, ...)
The replacement string contains a question mark (?)
Another rewrite, if, or set follows in the same scope

Characters like +, %, and & expand by two bytes during re-escaping, which is what pushes the write past the allocation.

Workaround if you can't patch immediately

Replace unnamed captures with named captures. Same behaviour, no overflow path.

# vulnerable
rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

# safe
rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

Checking your version

nginx -v

If it prints nginx/1.30.0 or older on the open-source branch, patch. On NGINX Plus, nginx -V includes the R-version and patch level.

For Plesk servers, the bundled NGINX is updated through the platform — run plesk installer update rather than swapping the binary by hand. cPanel admins running NGINX as a reverse proxy in front of Apache should rebuild EA4 once the upstream RPM lands, which is typically within 48 hours of an upstream release.

Is CVE-2026-42945 exploitable without authentication?+

Yes. The vulnerable code path is reached during normal HTTP request processing, before any auth layer. Any internet-facing NGINX with a matching rewrite rule is reachable.

Does the bug affect OpenResty or Tengine?+

Both vendor NGINX core unchanged, so both inherit the bug. Check the upstream version each one bundles and patch accordingly — OpenResty's release cadence trails mainline by a few weeks.

Will a WAF block exploitation?+

Partially. F5's NGINX App Protect WAF is itself listed as affected, so don't rely on it for this. A third-party WAF that strips question marks from URIs containing matched capture patterns helps, but the only complete fix is the patch.

Can I detect exploitation attempts in access logs?+

Crash attempts show up as worker process restarts in the error log (`worker process ... exited on signal 11`). Successful RCE leaves no obvious trace in access logs — assume compromise if you see repeated segfaults from unfamiliar source IPs.

Does this affect LiteSpeed or OpenLiteSpeed?+

No. LiteSpeed has its own HTTP engine and doesn't share the NGINX rewrite module. If you've migrated to LiteSpeed you're not exposed to this specific CVE.