New Nginx Exploit

CVE-2026-42945 is a heap buffer overflow in Nginx's ngx_http_rewrite_module, introduced in 2008, enabling unauthenticated RCE against servers using rewrite and set directives. The bug arises from a two-pass script engine where the length pass runs on a zeroed sub-engine missing the is_args flag, causing undersized buffers that overflow during the copy pass. Exploitation uses cross-request heap feng shui to corrupt an ngx_pool_t cleanup pointer, redirecting to system() on pool destruction; the vulnerability was autonomously discovered by depthfirst's security analysis system.