# NGINX RCE Flaw Exploited in the Wild

Published: 2026-05-18 · Severity: high
Canonical: https://vorant.io/reports/fe6c3fd7-9f55-5a14-81d2-6c888ffa1f14/nginx-rce-flaw-exploited-in-the-wild

> A heap buffer overflow in NGINX's rewrite module (CVE-2026-42945) is being actively exploited and can lead to remote code execution when ASLR is disabled.

MS-ISAC has issued an advisory covering four vulnerabilities in NGINX and related F5/NGINX products, the most severe being a heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945) that can be triggered via crafted HTTP requests. An unpropagated is_args flag causes an undersized buffer allocation, and subsequent copying of attacker-controlled escaped URI data past the heap boundary can lead to worker process crashes or, on systems without ASLR enabled, remote code execution. VulnCheck has reported this vulnerability being exploited in the wild, and a proof-of-concept has been published by DepthFirst, raising urgency for patching.

Three additional vulnerabilities were disclosed alongside the primary flaw: an excessive memory allocation bug in the SCGI/uWSGI modules (CVE-2026-42946) that can crash worker processes via a cross-buffer pointer subtraction bug, a use-after-free in the SSL module (CVE-2026-40701) tied to asynchronous OCSP DNS resolution timing, and an out-of-bounds read in the charset module (CVE-2026-42934) caused by mishandled incomplete UTF-8 sequences. Affected products span NGINX Open Source, NGINX Plus, NGINX Instance Manager, F5 WAF/DoS for NGINX, NGINX App Protect WAF/DoS, NGINX Gateway Fabric, and NGINX Ingress Controller across wide version ranges.

Given NGINX's ubiquity as web-serving and reverse-proxy infrastructure, and confirmed in-the-wild exploitation of the most severe flaw, organizations running affected versions should prioritize patching immediately. MS-ISAC recommends standard mitigations including prompt patch application, least-privilege configurations, network segmentation, vulnerability scanning, and exploit protection features.

## Mentioned in this report

- Vulnerabilities: CVE-2026-40701, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-nginx-could-allow-for-remote-code-execution_2026-051

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fe6c3fd7-9f55-5a14-81d2-6c888ffa1f14/nginx-rce-flaw-exploited-in-the-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup