CVE-2026-42945 is a critical vulnerability in NGINX's ngx_http_rewrite_module where improper buffer size calculation leads to a heap buffer overflow. An unauthenticated attacker can exploit this by sending crafted HTTP requests under specific rewrite configurations that use unnamed PCRE captures and a question mark in the replacement string. This overflow can cause a denial of service by crashing the NGINX worker process or, if ASLR is disabled, enable arbitrary code execution. Red Hat has released updated RPM packages including nginx-1.30.1-1.hum1 to fix this issue. The vulnerability is tracked under CWE-131 (Incorrect Calculation of Buffer Size) and has a Red Hat CVSS v3.1 base score of 8.1.

The vulnerability allows unauthenticated attackers to cause denial of service by crashing or restarting the NGINX worker process under default conditions. If ASLR is disabled, it can lead to arbitrary code execution, posing a critical risk to affected systems. This impacts confidentiality, integrity, and availability of the affected NGINX service. Exploitation requires specific, non-default rewrite configurations, limiting the attack surface to certain deployments.

Red Hat has released updated RPM packages (nginx-1.30.1-1.hum1 and related modules) that fix this vulnerability. Users should apply these official updates promptly to remediate the issue. No alternative mitigations are specified in the advisory. Since this is a critical security flaw, patching is the recommended and effective mitigation.