Report feedback

A remote unauthenticated attacker can, through a specific chaining of the rewrite and set directives using an unnamed PCRE capture and a question mark, trigger a heap buffer overflow, which leads to a restart of the worker process and, on systems with ASLR protection disabled or after it has been defeated by brute force, also to RCE.[5], [6].

The vulnerability is present in products:

• NGINX Open Source; >=1.0.0, <=1.30.0; >=0.6.27, <=0.9.7;
• NGINX Instance Manager; >=2.16.0, <=2.21.1;
• F5 WAF for NGINX; >=5.9.0, <=5.12.1;
• NGINX App Protect WAF; >=5.1.0, <=5.8.0; >=4.9.0, <=4.16.0;
• F5 DoS for NGINX; =4.8.0;
• NGINX App Protect DoS; >=4.3.0, <=4.7.0;
• NGINX Gateway Fabric; >=2.0.0, <=2.5.1; >=1.3.0, <=1.6.2;
• NGINX Ingress Controller; >=5.0.0, <=5.4.1; >=4.0.0, <=4.0.1; >=3.5.0, <=3.7.2;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-42945 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 13. 5. 2026.

A remote unauthenticated attacker capable of a MitM attack and with control over responses from the upstream server can, when the scgi_pass or uwsgi_pass directives are configured, exploit a vulnerability involving excessive memory allocation or reading data outside the allocated range, which allows them to read the memory of the NGINX worker process or force its restart. [7].

The vulnerability is present in products:

• NGINX Open Source; >=1.0.0, <=1.30.0; >=0.8.42, <=0.9.7;
• NGINX Instance Manager; >=2.16.0, <=2.21.1;
• F5 WAF for NGINX; >=5.9.0, <=5.12.1;
• NGINX App Protect WAF; >=5.1.0, <=5.8.0; >=4.9.0, <=4.16.0;
• NGINX Gateway Fabric; >=2.0.0, <=2.6.0; >=1.3.0, <=1.6.2;
• NGINX Ingress Controller; >=5.0.0, <=5.4.2; >=4.0.0, <=4.0.1; >=3.5.0, <=3.7.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

More information:

• CVE-2026-42946 at cve.org, NVD
• CWE-823: Use of Out-of-range Pointer Offset at cwe.mitre.org
• CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org

The vulnerability was publicly disclosed 13. 5. 2026.

A remote unauthenticated attacker can, when the ssl_verify_client directive is set to “on” or “optional” in combination with an active ssl_ocsp directive or a configured resolver, exploit a vulnerability involving unauthorized access to already freed heap memory during OCSP verification, which may lead to a restart of the NGINX worker process or to limited data modification [8].

The vulnerability is present in products:

• NGINX Open Source; >=1.19.0, <=1.30.0;
• NGINX Instance Manager; >=2.16.0, <=2.21.1;
• F5 WAF for NGINX; >=5.9.0, <=5.12.1;
• NGINX App Protect WAF; >=5.1.0, <=5.8.0; >=4.9.0, <=4.16.0;
• NGINX Gateway Fabric; >=2.0.0, <=2.5.1; >=1.3.0, <=1.6.2;
• NGINX Ingress Controller; >=5.0.0, <=5.4.1; >=4.0.0, <=4.0.1; >=3.5.0, <=3.7.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

More information:

• CVE-2026-40701 at cve.org, NVD
• CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 13. 5. 2026.