News Summary

• NGINX Plus and NGINX Open have a vulnerability in the ngx_http_rewrite_ module module.
• The vulnerability, discovered by depthfirst, is a heap buffer overflow issue.
• It could allow an attacker to achieve remote code execution or cause a denial-of-service (DoS) with crafted requests.
• The issue has been addressed in the following versions after responsible disclosure on April 21, 2026 - Users are advised to apply the latest versions for optimal protection..
• If immediate patching is not an option for CVE-2026-42945, users are advising to change the rewrite configuration by replacing unnamed captures with named captures in every affected rewrite directive.
• Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.