NGINX Rewrite Module RCE via Heap Buffer Overflow (CVE-2026-42945) — HackAdvisor

Description

NGINX is a widely used open-source web server, reverse proxy, load balancer, and HTTP cache commonly deployed in front of web applications and infrastructure services.

This laboratory contains the CVE-2026-42945 vulnerability affecting NGINX Open Source and NGINX Plus under specific rewrite configuration conditions. The vulnerability is rated Critical with a CVSS score of 9.2.

The flaw exists in the ngx_http_rewrite_module when a rewrite directive is followed by another rewrite, if, or set directive, uses an unnamed PCRE capture such as $1 or $2, and includes a question mark (?) in the replacement string. An unauthenticated attacker can send crafted HTTP requests that trigger a heap buffer overflow in the NGINX worker process.

English summary: A lab running nginx/1.31.0 with ASLR disabled. The nginx configuration contains a vulnerable rewrite+set pattern that triggers CVE-2026-42945 — a heap buffer overflow in the rewrite module. The goal is to achieve RCE and read /secret.txt from the target server at 172.20.36.209:80.

Analysis

Reconnaissance

The target runs nginx/1.31.0 on port 80 with the following endpoints:

Endpoint	Response	Notes
/	200 "ok"	Catch-all location
/api/test	200 "backend ok"	Rewrite active, proxied to backend on port 19323
/spray	200 "backend ok"	Spray endpoint for heap feng shui, proxied to backend
/internal	404	Internal directive, not directly accessible

Vulnerable nginx configuration

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;
    set $original_endpoint $1;
}

This configuration triggers CVE-2026-42945 because:

1. The rewrite directive uses ? in the replacement string (/internal?migrated=true)
2. It is followed by a set directive that references an unnamed PCRE capture ($1)

...