CVE-2026-42945: a single HTTP request takes NGINX down

What does this NGINX flaw actually do?

The URL rewrite module handles a crafted request without correctly checking its buffer bounds. Immediate result: the worker process dies. Repeat the request and the server stops serving anything: denial of service, unauthenticated, with no particular attack volume.

On systems where ASLR is disabled, exploitation does not stop at the crash: a working proof-of-concept demonstrating full remote code execution was already circulating publicly when mass exploitation started.

How did a flaw sit eighteen years in the code?

The flaw was introduced in 2008 and nobody saw it until 2026. That is a useful correction to "mature software, therefore safe" reasoning: a component’s age says nothing about its safety, only how long that particular path has gone unreviewed.

And because the vulnerable configuration pattern is common, the exposed population is enormous: every internet-reachable NGINX instance using that rewrite pattern.

What does it change in your threat model?

Here the flaw is not in your application. It is in the web server itself: underneath Magento, underneath WordPress, underneath your in-house API. Underneath everything you expose.

Put differently: a security plan that only looks at the CMS misses it. The layer that receives the request matters as much as the one that processes it.

What should you do today?

Update NGINX. That is the only real fix: a flaw in the web server is fixed in the web server.

While you are at it, confirm ASLR is enabled on your hosts. That is the difference between "my server restarts" and "someone is running code on my box".

Take inventory: forgotten instances (staging, an old subdomain, a vendor appliance) are the ones that stay vulnerable longest.