NGINX Plus: memory corruption

NGINX Plus

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?).

Fix it

NGINX Plus

On 37.xUpgrade to NGINX Plus R37
On 36.xNo fix on 36.x yet
On 32.xNo fix on 32.x yet

NGINX Open Source

On 1.30.xUpgrade to NGINX Open Source 1.30.1
On 1.31.xUpgrade to NGINX Open Source 1.31.0

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 03:17 UTC
Fixed in: NGINX Plus R37
NGINX Open Source 1.31.0
NGINX Open Source 1.30.1
Identifiers: CVE-2026-42945
CVSS: 8.1
Source: news
On the menu as: nginx

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## NGINX Plus: memory corruption
Severity: high. Patch status: patched.
Affected: NGINX Plus
Fixed in: NGINX Plus R37, NGINX Open Source 1.31.0, NGINX Open Source 1.30.1
Ids: CVE-2026-42945

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?).

## Steps
1. This touches infrastructure (nginx). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: NGINX Plus: R37; R36.x → no fix on 36.x yet; R32.x → no fix on 32.x yet. NGINX Open Source: 1.31.0; 1.30.1.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| NGINX Plus | fixed | R37 | — |
| NGINX Plus R36.x, R32.x | migrate | move to R37 | restrict network access to it |
| NGINX Open Source | fixed | 1.31.0 | — |
| NGINX Open Source | fixed | 1.30.1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-42945") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://my.f5.com/manage/s/article/K000161019 https://nvd.nist.gov/vuln/detail/CVE-2026-42945
https://pwned.coffee/i/ngx-http-rewrite-module-critical-vulnerability-cve-2026-42945

Timeline

26 Oct 2026, 03:17 UTC
Fix status: unknown → patched.
26 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
NGINX Plus before R37 R37 CVE record (CNA) checked 26 Oct
NGINX Plus R36 to now no fix on 36.x yet CVE record (CNA) checked 26 Oct
NGINX Plus R32 to now no fix on 32.x yet CVE record (CNA) checked 26 Oct
NGINX Open Source before 1.31.0 1.31.0 CVE record (CNA) checked 26 Oct
NGINX Open Source before 1.30.1 1.30.1 CVE record (CNA) checked 26 Oct
Score: CVSS 8.1 (high). CVSS 3.1 8.1 (CNA f5) for CVE-2026-42945
Last checked: 26 Oct 2026, 03:17 UTC

Product	Affected	Fixed in	Source
NGINX Plus	before R37	R37	CVE record (CNA) checked 26 Oct
NGINX Plus	R36 to now	no fix on 36.x yet	CVE record (CNA) checked 26 Oct
NGINX Plus	R32 to now	no fix on 32.x yet	CVE record (CNA) checked 26 Oct
NGINX Open Source	before 1.31.0	1.31.0	CVE record (CNA) checked 26 Oct
NGINX Open Source	before 1.30.1	1.30.1	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone hot coffee