Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945

A critical heap-buffer-overflow vulnerability (CVE-2026-42945, “NGINX Rift”) in ngx_http_rewrite_module affecting NGINX Plus and Open Source is being actively exploited; the flaw is triggered by specific rewrite patterns involving unnamed PCRE groups and a question mark in replacements, leading to a deterministic heap overflow. Public analysis and a PoC show exploitation potential but note that real-world remote code execution is unlikely without a specific vulnerable NGINX configuration and ASLR being disabled.