NGINX Rift: an 18-year-old flaw in the world’s most deployed web server just came to light

Researchers disclosed a critical 18‑year‑old heap buffer overflow in NGINX (CVE-2026-42945, "NGINX Rift") that can enable unauthenticated remote code execution by sending a specially crafted HTTP request when certain rewrite directive patterns (unnamed PCRE captures with question-mark replacements) are present; the flaw affects many NGINX Open Source and NGINX Plus releases and related F5/NGINX products, patches and configuration workarounds were released on April 21, 2026, and three additional NGINX vulnerabilities were published alongside the Rift advisory.