DepthFirst's AI Scanner Surfaces NGINX Rift, an 18-Year-Old Heap Overflow in the Rewrite Module That Enables Unauthenticated RCE
An LLM-powered scanner from security startup DepthFirst flagged a heap buffer overflow that had sat undetected in NGINX's rewrite module for roughly 18 years, prompting F5 to ship coordinated patches on May 13.
Overview
A critical heap buffer overflow in NGINX’s URL rewrite module sat undetected for 18 years before an autonomous AI scanner flagged it in a single six-hour code scanning session. F5 disclosed the flaw, dubbed NGINX Rift, on May 13, 2026 as CVE-2026-42945 with a CVSS v4 score of 9.2, and shipped coordinated patches across the open-source release line and the commercial NGINX Plus product. The bug is one of four memory-corruption issues reported by security startup DepthFirst, whose LLM-powered platform discovered the chain on April 18 and notified F5 three days later.
The discovery lands with unusual weight because NGINX is, by CSO Online’s count, powering almost one third of all websites on the internet. It also marks another data point in the growing track record of AI-assisted vulnerability research turning up decades-old flaws in critical infrastructure.
What We Know
The vulnerability lives in ngx_http_rewrite_module and has been in the project’s code for roughly 18 years, affecting NGINX Open Source releases from 0.6.27 through 1.30.0 and NGINX Plus releases R32 through R36, as documented by BleepingComputer. The same advisory notes that the flaw also reaches into derivative products including NGINX Instance Manager 2.16.0 through 2.21.1, NGINX App Protect WAF 4.9.0 through 5.8.0, NGINX Gateway Fabric 1.3.0 through 2.5.1, and NGINX Ingress Controller 3.5.0 through 5.4.1. F5 published fixes in NGINX Open Source 1.31.0 and 1.30.1 and in NGINX Plus R36 P4 and R32 P6.
According to The Hacker News, the bug is reachable only when a configuration combines specific ingredients: a rewrite directive that uses an unnamed Perl-Compatible Regular Expression capture such as $1 or $2, a replacement string that contains a question mark, and a subsequent rewrite, if, or set directive. BleepingComputer attributes the underlying defect to inconsistent state handling in NGINX’s internal script engine, which processes rewrites in two passes: one to calculate the amount of memory to allocate, and one to copy the actual data. An is_args flag remains active after rewrites containing a ?, leaving the engine to size the destination buffer against an unescaped URI length while writing the larger, re-escaped data, and the result is a heap overflow in the worker process.
DepthFirst researcher Zhenpeng Lin described the architectural property that makes the bug exploitable in practice. “Nginx uses a multi process architecture where worker processes fork from a single master process,” Lin told CSO Online. “Because of this design, the memory space is duplicated exactly for every child worker.” He also noted that the pairing of rewrite and set directives, the specific configuration that triggers the flaw, are “common building blocks in API gateway configurations.”
The published proof-of-concept demonstrates, according to BleepingComputer, “unauthenticated code execution via specially crafted HTTP requests that corrupt adjacent NGINX memory pool structures, overwrite cleanup handler pointers, spray fake structures into memory via POST request bodies, and force NGINX to execute ‘system()’ during pool cleanup.” The PoC code is public on the DepthFirst Disclosures repository on GitHub alongside the three accompanying CVEs.
BleepingComputer reports that F5’s interim mitigation, for operators who cannot upgrade immediately, is to replace unnamed PCRE capture groups such as $1 and $2 in vulnerable rewrite rules with named captures, which eliminates the main exploitation prerequisite.
The Three Companions
DepthFirst’s scan returned four issues in total, all patched in the same coordinated releases. Alongside CVE-2026-42945, BleepingComputer lists CVE-2026-42946, an excessive-memory-allocation flaw in the SCGI and uWSGI modules; CVE-2026-40701, a use-after-free in asynchronous OCSP DNS resolution; and CVE-2026-42934, an off-by-one bug in UTF-8 parsing. CSO Online assigns CVSS scores of 8.3 to CVE-2026-42946 and 6.3 to both CVE-2026-42934 and CVE-2026-40701.
What We Don’t Know
F5 has not, as of the May 13 advisory, reported any in-the-wild exploitation of CVE-2026-42945. None of the cited outlets place active attacks against the rewrite-module bug in a specific campaign or threat-actor cluster.
The practical RCE bar is also unsettled. BleepingComputer notes that DepthFirst’s proof-of-concept required Address Space Layout Randomisation to be disabled, a non-default condition on mainstream Linux distributions, and that security researcher Kevin Beaumont and AlmaLinux maintainers have argued that turning the heap overflow into reliable remote code execution on ASLR-enabled systems is harder than the PoC suggests. The same write-up records that crashing NGINX worker processes via crafted requests is straightforward, putting the denial-of-service path within reach of any unauthenticated attacker who can talk to a vulnerable server over HTTP.
How many of the world’s NGINX deployments meet the precise configuration conditions for the bug is also unclear; the cited reporting does not quantify the exposed population beyond the broad observation that rewrite-and-set combinations are widely used in API-gateway and reverse-proxy setups.
Analysis
NGINX Rift is the second high-profile case this spring of an AI-assisted scanner uncovering a decades-old vulnerability in widely deployed software. The pattern matters because the bug class is exactly the kind that traditional fuzzers and static analyzers have historically struggled with: a state-machine inconsistency between two passes of the same engine, triggered only by a narrow combination of directives most users will never encounter, but reachable from unauthenticated remote input once that combination exists. DepthFirst’s Lin framing — that worker forking preserves heap layout precisely enough for repeated exploitation attempts to succeed — also illustrates how the architectural choices that gave NGINX its reputation for performance and stability now factor into the exploitability calculus when a single flaw lands in the rewrite engine.
For operators, the practical posture is straightforward: upgrade to NGINX 1.31.0, 1.30.1, NGINX Plus R36 P4, or NGINX Plus R32 P6 per The Hacker News, or apply F5’s named-capture mitigation in the interim. For the industry, the more lasting question is whether AI-assisted disclosure pipelines will compress the half-life of latent memory-corruption bugs in mature open-source code — and whether vendors are ready for the volume of advisories that compression implies.