Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

NGINX rewrite-rule workaround for CVE-2026-42945

Advisory/Mitigation
First reported
Last updated
Happening score
H score 23
1 unique sources, 1 articles

Summary

Hide ▲

F5 issued a workaround for vulnerable NGINX rewrite rules, reducing exposure to CVE-2026-42945 for operators who cannot upgrade immediately. The guidance replaces unnamed PCRE capture groups ($1, $2, etc.) with named captures. That change removes the main exploitation prerequisite in affected NGINX configurations. The mitigation is meant to bridge deployments until fixed versions can be installed.

Related Happenings

F5 security patch release for CVE-2026-42530

Security Patch Release
H score39 First: 18.06.2026 20:32 Last: 18.06.2026 20:32 Sources 1

About this happening: **F5** released security updates for **NGINX Open Source** after finding **two critical vulnerabilities** that could lead to **remote code execution** on affected systems. The pat...

Open Happening

NGINX web server critical flaws (multiple vulnerabilities)

Vulnerability
H score38 First: 18.06.2026 14:33 Last: 18.06.2026 14:33 Sources 1

About this happening: **NGINX** had two critical web server vulnerabilities, **CVE-2026-42530** and **CVE-2026-42055**, that can let **remote unauthenticated attackers** trigger **remote code execution...

Open Happening

F5 NGINX out-of-band security updates (multiple vulnerabilities)

Security Patch Release
H score34 First: 18.06.2026 14:33 Last: 18.06.2026 14:33 Sources 1

About this happening: **F5** released **out-of-band security updates** for **NGINX** after finding multiple web server vulnerabilities, including **two critical flaws** that could enable **remote code...

Open Happening

Nginx security patch release for CVE-2026-49975

Security Patch Release
H score42 First: 03.06.2026 22:08 Last: 03.06.2026 22:08 Sources 1

About this happening: Vendors released fixes for the **HTTP/2 Bomb** DoS issue, closing a path that could let a **single client** exhaust server memory within seconds. The patch set covers **nginx 1.29...

Open Happening

Ivanti security patch release for CVE-2026-8043

Security Patch Release
H score25 First: 18.05.2026 13:54 Last: 18.05.2026 13:54 Sources 1

About this happening: **Ivanti, Fortinet, SAP, Broadcom, and n8n** released **security fixes** on **2026-05-18** for flaws that could enable **authentication bypass**, **remote code execution**, **SQL...

Open Happening

Timeline

  1. 14.05.2026 18:43 1 articles · 1mo ago

    DepthFirst AI discovers CVE-2026-42945 in NGINX

    Technical Analysis Update

    DepthFirst AI identifies CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX Open Source, during a six-hour autonomous code scanning session.

    Show sources
    Open in new tab
  2. 13.05.2026 03:00 2 articles · 1mo ago

    F5 releases a workaround for vulnerable NGINX rewrite rules

    Mitigation Patch Update

    F5 releases mitigation guidance for vulnerable NGINX rewrite rules, advising operators who cannot upgrade to replace unnamed PCRE capture groups ($1, $2, etc.) with named captures so the main exploitation prerequisite is removed.

    Show sources
    Open in new tab
  3. 21.04.2026 03:00 1 articles · 2mo ago

    Researchers report CVE-2026-42945 to the vendor

    Initial Disclosure

    Researchers report CVE-2026-42945 to the vendor, identifying a heap buffer overflow in ngx_http_rewrite_module that affects NGINX versions 0.6.27 through 1.30.0.

    Show sources
    Open in new tab