{"id":12850,"date":"2026-05-14T10:04:31","date_gmt":"2026-05-14T10:04:31","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/14\/critical-18-year-old-nginx-vulnerability-enables-remote-code-execution-attacks\/"},"modified":"2026-05-14T10:04:31","modified_gmt":"2026-05-14T10:04:31","slug":"critical-18-year-old-nginx-vulnerability-enables-remote-code-execution-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/14\/critical-18-year-old-nginx-vulnerability-enables-remote-code-execution-attacks\/","title":{"rendered":"Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks"},"content":{"rendered":"

Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical heap buffer overflow vulnerability has been discovered in the source code of NGINX, present since 2008.<\/p>\n

This vulnerability has been publicly disclosed, along with a working proof-of-concept exploit that can enable unauthenticated remote code execution (RCE) against one of the most widely used web servers in the world.<\/p>\n

Assigned a CVSS score of 9.2,\u00a0CVE-2026-42945\u00a0resides in NGINX\u2019s\u00a0ngx_http_rewrite_module.<\/p>\n

This engine powers URL rewriting and variable assignment in virtually every modern NGINX deployment.<\/p>\n

The bug was first introduced in version 0.6.27, released in\u00a02008, and remained undetected for 18 years across all versions up to 1.30.0.<\/p>\n

18-Year-Old NGINX RCE Vulnerability<\/strong><\/h2>\n

The flaw is triggered when a configuration uses both\u00a0rewrite\u00a0and\u00a0set\u00a0directives together, a common pattern in API gateway setups.<\/p>\n

NGINX\u2019s internal script engine<\/a> processes these directives using a\u00a0two-pass system: the first pass calculates memory length, and the second writes data into the allocated buffer.<\/p>\n

The critical flaw lies in a state mismatch between the two passes. When a\u00a0rewrite\u00a0directive contains a question mark (?), it permanently sets an\u00a0is_args = 1\u00a0flag on the main script engine.<\/p>\n

However, during the first (length calculation) pass, a zeroed-out sub-engine is used, meaning\u00a0is_args\u00a0is effectively zero. The length is calculated without accounting for URI escaping.<\/p>\n

\"NGINX
NGINX Hit by 4 Memory Flaws (source:depthfirst)<\/figcaption><\/figure>\n

In the second (copy) pass, the main engine runs with\u00a0is_args = 1, causing the\u00a0ngx_escape_uri\u00a0function to\u00a0expand each escapable byte from 1 to 3 bytes.<\/p>\n

The result: far more data is written to the buffer than was allocated, leading to a classic heap buffer overflow.<\/a><\/p>\n

Researchers developed a working RCE exploit for systems with ASLR disabled.<\/p>\n

The security research firm depthfirst autonomously discovered the vulnerability<\/a>\u00a0during an April 2026 code audit that also uncovered three additional memory corruption bugs.<\/p>\n

The attack chains heap manipulation, fake cleanup structure spraying via POST bodies, and NGINX\u2019s deterministic multi-process architecture to achieve\u00a0reliable, repeatable code execution. A public PoC is now available on GitHub.<\/p>\n