Tag: NGINX Open Source

Numerous security flaws affecting NGINX Plus and NGINX Open have been revealed by cybersecurity researchers, including a serious one that went unnoticed for eighteen years. A heap buffer overflow vulnerability affecting ngx_http_rewrite_module (CVE-2026-42945, CVSS v4 score: 9.2) was found by depthfirst. This vulnerability could allow an attacker to execute code remotely or launch a denial-of-service (DoS) using specially constructed requests. The coding name for it is NGINX Rift. The ngx_http_rewrite_module module of NGINX Plus and NGINX Open Source is vulnerable, according to a warning issued by F5 on Wednesday. This vulnerability arises when an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g., $1, $2) with a replacement string that contains a question mark (?) is f...