NGINX Rift: An 18-Year-Old Flaw in the World’s Most Deployed Web Server Just Came to Light

Key Takeaways

• NGINX Rift (CVE‑2026‑42945) is a heap overflow with CVSS 9.2.
• Affected versions span NGINX 0.6.27‑1.30.0 and Plus R32‑R36.
• Exploit requires a crafted URI; can achieve remote code execution without auth.
• Patch released April 21 2026; upgrade to 1.30.1/1.31.0 or Plus R36 P4.
• Workaround: replace unnamed PCRE captures with named captures in rewrite rules.

Pulse Analysis

NGINX remains the most widely deployed web server and reverse‑proxy platform, underpinning everything from small blogs to massive cloud‑native architectures. The discovery of NGINX Rift highlights how legacy code paths can linger unnoticed for decades, especially in modules like ngx_http_rewrite_module that are compiled into virtually every build. By exploiting a subtle mismatch in URI‑escaping logic, an attacker can force a heap overflow that is fully controllable via the request URI, turning a routine HTTP call into a remote code execution vector.

From a security operations perspective, the vulnerability is especially dangerous because it requires no prior authentication, no session hijacking, and can be triggered with a single crafted request. Environments that disable ASLR—or that run older, unpatched versions—face immediate RCE risk, while even hardened systems can suffer repeated crashes that degrade service availability. The fact that the overflow is deterministic, not random, lowers the barrier for reliable exploit development, prompting organizations to reassess their NGINX hardening practices and to audit rewrite rules for the risky unnamed capture pattern.

The coordinated disclosure resulted in patches for both Open Source and commercial NGINX Plus releases within days, underscoring the vendor’s responsiveness. Administrators should prioritize upgrading to NGINX 1.30.1 or later, or apply the Plus R36 P4 patch, and restart workers to load the fixed binary. Where immediate upgrades are impractical, switching to named PCRE captures offers a zero‑downtime mitigation. This incident serves as a reminder that even mature, high‑profile software can harbor deep‑seated flaws, reinforcing the need for continuous vulnerability scanning and proactive configuration reviews.