CVE-2026-42945 is a critical heap buffer overflow vulnerability in NGINX's ngx_http_rewrite_module introduced in 2008. The issue stems from a two-pass script engine process where the length calculation pass does not account for URI escaping, causing an undersized heap buffer during the copy pass. This leads to overflow of attacker-controlled URI data, enabling corruption of an adjacent ngx_pool_t's cleanup pointer. The corrupted pointer can be redirected to a fake cleanup structure that invokes system() on pool destruction, resulting in remote code execution without authentication. The vulnerability affects NGINX Open Source versions 0.6.27 through 1.30.0 and NGINX Plus versions R32 through R36. Fixed versions include NGINX Open Source 1.30.1 and 1.31.0, and NGINX Plus R32 P6, R35 P2, and R36 P4. The exploit requires environment-specific adjustments due to differences in memory layout and offsets across OS versions.

Successful exploitation of this heap buffer overflow allows unauthenticated remote attackers to execute arbitrary code on vulnerable NGINX servers. This can lead to full system compromise, unauthorized access, and control over the affected server. The vulnerability impacts a wide range of NGINX versions and can be triggered remotely via crafted URI requests using rewrite and set directives. No confirmed active exploitation in the wild has been reported at this time.

Official fixes are available for this vulnerability. Users should upgrade to NGINX Open Source versions 1.30.1 or later, or NGINX Plus versions R32 P6, R35 P2, or R36 P4 and later. Applying these updates will remediate the heap buffer overflow and prevent exploitation. Since this is not a cloud service, manual patching by administrators is required. Check the vendor advisory at https://my.f5.com/manage/s/article/K000160932 for detailed patching instructions and confirmation of fixed versions.