NGINX Rift (CVE-2026-42945): an 18-year-undetected heap overflow on the ingress tier

An 18-Year-Old Heap Overflow on the World’s Most-Deployed Reverse Proxy

On May 13, 2026, F5 and the depthfirst research team jointly disclosed CVE-2026-42945 — nicknamed NGINX Rift — a heap buffer overflow in the ngx_http_rewrite_module of NGINX. CVSS v4 9.2. Three additional memory-corruption vulnerabilities (CVE-2026-42946 at CVSS 8.3, CVE-2026-40701 at CVSS 6.3, CVE-2026-42934 at CVSS 6.3) shipped in the same advisory, all sharing the same root-cause family.

The vulnerable code path has been present in ngx_http_rewrite_module for roughly eighteen years. It affects every NGINX Open Source release from 0.6.27 through 1.30.0 and NGINX Plus R32 through R36. The fixed versions are NGINX Open Source 1.30.1 and 1.31.0, and NGINX Plus R32 P6 and R36 P4. Responsible-disclosure window: April 18, 2026 (initial F5 notification) through May 13, 2026 (coordinated public disclosure).

The vulnerability triggers when a rewrite directive is followed by a rewrite, if, or set directive that uses an unnamed Perl-Compatible Regular Expression capture ($1, $2, and so on) with a replacement string that includes a ? character. The internal is_args flag remains set after the rewrite, causing NGINX to size the destination buffer using the unescaped URI length while later writing larger escaped data — + and & characters — into that buffer. The result is a heap buffer overflow in the worker process.

A single crafted HTTP request from an unauthenticated remote attacker triggers the overflow. On a target host with ASLR enabled — the default on every mainstream Linux distribution — the overflow reliably crashes the worker process, which NGINX restarts. Repeated requests yield a sustained denial of service against the reverse-proxy tier. On a target host with ASLR disabled, the depthfirst team demonstrated remote code execution from the same single-request primitive.

The Vulnerability Was Found in Six Hours by an AI System After Eighteen Years of Human Review

The disclosure included a quiet but structurally significant footnote: the vulnerable construct was identified by depthfirst’s AI-driven vulnerability-analysis system in roughly six hours of model time. Eighteen years of conventional human code review, fuzz-testing, and static analysis missed it.

That is the story of the 2026 vulnerability research perimeter in one bullet point. Across April and May of 2026 the same pattern has surfaced repeatedly: Microsoft Security’s MDASH harness disclosed sixteen new Windows CVEs on May 12 using a one-hundred-plus specialized-agent orchestration. OpenAI’s Aardvark agent is in deployment as an autonomous security researcher. Anthropic’s Claude Mythos preview was announced for general-purpose autonomous vulnerability discovery on April 7. The PraisonAI CVE-2026-44338 advisory (May 14) saw first targeted exploitation three hours forty-four minutes after publication — the exploitation pipeline is now as automated as the discovery pipeline.

For a platform team running NGINX as the public ingress for production traffic, the practical implication is that “an eighteen-year-undetected bug in a foundational reverse-proxy component” is no longer the unusual case. It is the leading edge of a steady-state cadence of AI-discovered high-severity flaws against the components platform teams have most-deployed. The 2026 reverse-proxy posture has to assume that the bug under the next CVE-watch alert was found yesterday by an autonomous agent and is being scanned for today by a different autonomous agent.

Why the Ingress Tier Is a Distinct Posture Problem

Patching a vulnerability in a fleet of NGINX reverse proxies is not the same operation as patching a kernel-level CVE on a worker-node fleet or a Cisco Catalyst SD-WAN Controller (CVE-2026-20182). The shape of the work is different in five concrete ways.

• The ingress tier is the public-internet-facing edge. Every external request transits a worker process. A worker-process crash is a request failure visible to end users. A worker-process RCE is a foothold inside the trust boundary.
• The ingress tier sees the request before any application authentication. The auth context the rest of the application stack relies on does not exist yet at the moment NGINX is parsing the URI. The pre-auth surface is the surface the bug exposes.
• The vulnerable construct is a configuration pattern, not just a software version. Even on a patched binary, configurations using unnamed PCRE captures with a replacement string containing ? are still the construct the AI system flagged. The named-capture refactor is the durable mitigation regardless of patch state.
• The fleet is large. Mid-market enterprises typically run dozens of NGINX instances; large enterprises run thousands. Hundreds of those are likely public-internet-facing. The patch unit is the instance; the consequence of an unpatched instance is fabric-wide exposure.
• The rotation path is blue-green at the load balancer, not in place. The reliable remediation primitive is “stand up the new-version ingress pool, drain the old pool’s connections, decommission the old pool.” In-place upgrades risk worker-process restarts mid-connection.

The work is operational, continuous, and crosses the security-agent and the resource-operations-agent pillars. It is not a once-a-quarter audit task. In 2026 it is part of the daily-operations envelope of the platform team.

The 2026 Ingress-Tier Posture for NGINX

Five operational capabilities that a 2026 platform team running NGINX as the public ingress should have running continuously against the reverse-proxy CVE-watch:

1. Continuous reverse-proxy CVE-watch. Every NGINX instance has its installed version (Open Source or Plus, exact release, exact patch level) and its mapping to upstream CVEs tracked in a live inventory. The inventory is queryable on the same MCP surface the rest of the platform team uses. KEV-listed CVEs against the inventory are promoted to the top of the patch queue automatically.

2. Configuration-graph diff against the vulnerable-construct pattern. A continuous baseline of every NGINX configuration file across the fleet is captured, parsed, and graph-queried for the vulnerable construct — rewrite directives followed by rewrite, if, or set directives with unnamed PCRE captures and ?-containing replacement strings. Configurations matching the pattern are surfaced as named-capture-refactor candidates regardless of patch state.

3. Blue-green ingress-tier rotation with deliberate connection drain. The remediation primitive is “stand up the new-version ingress pool, drain the old pool’s connections via the load balancer, decommission the old pool,” not in-place upgrade. The deployment-agent applies the rotation, drains long-lived WebSocket and SSE connections in controlled groups, surfaces stuck migrations as exceptions, and ships an explicit audit-trail entry for every ingress instance rotated.

4. Named-capture refactor as the no-downtime mitigation. For configurations that cannot be patched immediately (third-party-managed appliances, custom forks, frozen-version vendor stacks), the durable mitigation is the named-capture refactor. The security-agent proposes the refactor as a remediation PR against the configuration repository; the deployment-agent applies it; the audit trail captures the diff. The refactor is the same operation whether the binary is patched or not.

5. Immutable audit trail of every ingress rotation, every refactor, every exception. Every NGINX instance rotated, every configuration refactored, every named-capture migration, every exception granted lands in the customer’s per-tenant audit-trail store, with the CVE reference, the KEV deadline where one exists, the rotation duration, and the human approver where one was required. The audit trail is the reconciliation artifact for internal audit, external auditors, and cyber insurance.

Each capability is achievable by a small platform team with the right tooling and the active operational layer to run it on. None of them is achievable by a small platform team with manual processes, given the 2025 record of 48,185 published CVEs and the 2026 cadence of AI-discovered high-severity disclosures against the foundational infrastructure components.

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

The Ingress Posture Crosses Two Agent Pillars

Most discussions of reverse-proxy security frame it as a network-engineering task or a security-engineering task. The 2026 operational reality is that the work crosses two agent pillars on the platform team.

• Security agent. Tracks the CVE catalog, the KEV deadline status, and the per-instance exposure score. Parses every NGINX configuration in the fleet for the vulnerable-construct pattern. Produces the patch-priority queue and the refactor-priority queue, surfaces unpatched instances against the deadline, and proposes named-capture-refactor PRs against the configuration-as-code repository.
• Resource-operations agent. Maintains the instance inventory, tracks the software-version-versus-vendor-release lag, and proposes the blue-green rotation plan. Tags every NGINX instance with its current version, last rotation date, current patch status, and current configuration-pattern exposure.

The two work as a coordinated team. A security-agent that surfaces the CVE but cannot drive the ingress rotation is a dashboard. A resource-agent that rotates NGINX instances without security-context is rotation theatre. The 2026 platform-engineering shape is the two pillars working together on the same operational fabric.

How IAN Helps: The Security and Resource-Operations Agents on the Active Operational Layer

IAN is the AI DevOps team for cloud infrastructure, delivered as a coordinated team of specialized agents on the active operational layer. The ingress-tier-posture pattern lives in the intersection of two IAN agents.

• Security agent reverse-proxy CVE-watch. The security agent watches the CISA KEV catalog, NVD, vendor advisories (F5 PSIRT in this case), and threat-actor disclosures. It correlates each CVE to the deployed NGINX inventory and produces a per-instance exposure score with the KEV deadline as the top priority signal. It also parses the configuration-as-code repository for the vulnerable-construct pattern and surfaces named-capture-refactor candidates as Operate-tier remediation PRs.
• Resource-operations agent ingress inventory. The resource-agent maintains a live inventory of every NGINX instance across every connected cloud account — public-facing edge proxies, internal service meshes, embedded sidecars, third-party-managed appliances where the version is visible — with software version, deployment date, last rotation, configuration-pattern exposure, and current patch status. The inventory is the input the security-agent and the deployment-agent read.
• Deployment / SRE agent ingress rotation. The deployment-agent applies the blue-green rotation, drains connections in controlled groups, surfaces stuck migrations as Operate-tier remediation candidates, and ships an explicit audit-trail entry for every NGINX instance replaced.
• Capability-tier governance on every action. Observe-tier scans (CVE-to-instance correlation, vulnerable-construct configuration parsing, blast-radius mapping) run automatically. Operate-tier remediations (ingress rotation, named-capture refactor PR, connection drain) require pre-authorization once. Administer-tier actions (fleet-wide policy changes, exception grants beyond the KEV deadline, rotation-policy changes) require explicit human approval with separation-of-duties.
• BYOK on model keys. Customers bring their own Anthropic / OpenAI keys. The agent layer does not see ingress-tier rotation as an LLM-call-markup opportunity. Pricing is usage-based on orchestration actions, with a monthly minimum.
• Immutable audit trail. Every CVE-watch alert, every rotation, every refactor PR, every exception grant, every configuration diff lands in the customer’s per-tenant audit-trail store.

The Three-Phase Rollout

Phase 1 — Observe the ingress-tier posture across the fleet. Run the security-agent Observe pass against every NGINX instance, surface the software-version inventory, the per-instance CVE exposure, the configuration-pattern exposure (named-capture coverage versus unnamed-capture exposure), and the KEV-deadline slack. Two-to-four weeks.

Phase 2 — Codify the rotation and refactor policy and promote to Operate-tier. Pre-authorize the ingress-rotation scope, the connection-drain policy, and the named-capture-refactor PR primitive. Codify the exception path with explicit justification and audit-trail capture. Two-to-three months.

Phase 3 — Cross the security / resource / deployment agent loop. Rotation events feed the deployment-agent’s release-window planner. Refactor events feed the configuration-as-code review queue. CVE-disclosure events become availability, resource, and security signals against the ingress tier simultaneously.

NGINX Rift’s eighteen-year-undetected history is the headline window. The structural lesson is that the foundational components of the modern reverse-proxy and ingress tier are now subject to a steady-state cadence of AI-discovered high-severity disclosures, and the active operational layer is the shape that makes the posture tractable for a small platform team.

Get a free infrastructure audit → | See pricing →