CVE-2026-42945 is a heap-based buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source. The flaw arises when a rewrite directive is followed by rewrite, if, or set directives that use unnamed Perl-Compatible Regular Expression (PCRE) captures (e.g., $1, $2) with replacement strings containing a question mark (?). This can be exploited by unauthenticated attackers sending crafted HTTP requests, leading to a heap buffer overflow in the NGINX worker process. The overflow may cause the worker process to restart and, on systems with Address Space Layout Randomization (ASLR) disabled or bypassed, may allow arbitrary code execution. The vulnerability affects certain NGINX Plus versions (R32 and R36). Red Hat has published multiple advisories and errata providing security updates that fix this vulnerability, including updated nginx packages for Red Hat Enterprise Linux 10.0 Extended Update Support. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation can cause a heap buffer overflow in the NGINX worker process, resulting in process restart (denial of service). On systems where ASLR is disabled or can be bypassed, attackers may achieve arbitrary code execution, compromising system confidentiality, integrity, and availability. The vulnerability is exploitable remotely by unauthenticated attackers via crafted HTTP requests.

Red Hat has released security updates that address this vulnerability. Users should apply the updated nginx packages provided in the Red Hat advisories (e.g., RHSA-2026:17790) for Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions. No other mitigations or workarounds are specified. Patch status is confirmed by vendor advisories; applying these official fixes mitigates the vulnerability.