18-Year-Old NGINX Flaw Enables Remote Code Execution Attacks – PoC Released

**Executive summary:** A critical heap buffer overflow (CVE-2026-42945, dubbed "NGINX Rift") in NGINX's ngx_http_rewrite_module enables unauthenticated remote code execution; a proof-of-concept and a working exploit have been published. The flaw affects NGINX Open Source 0.6.27–1.30.0 and multiple F5/NGINX products; F5 published an advisory and administrators are urged to upgrade to NGINX 1.31.0 or 1.30.1, with configuration mitigations advised for those who cannot immediately patch. Three additional NGINX vulnerabilities were also disclosed.