18-Year-Old NGINX Flaw Allows Unauthenticated RCE

An 18-year-old NGINX flaw has emerged as a significant cybersecurity threat. Depthfirst recently identified a critical vulnerability in both NGINX Plus and NGINX Open, which could have severe implications for server security. This flaw is a heap buffer overflow issue within the ngx_http_rewrite_module, tagged as CVE-2026-42945, with a CVSS v4 score of 9.2. Such a vulnerability potentially allows an attacker to gain remote code execution capabilities or disrupt server functions.

NGINX, a popular web server, has remained vulnerable to this oversight for nearly two decades, underscoring the persistent challenges in maintaining software security. Cybersecurity researchers emphasize the importance of immediate remedial measures to protect against potential exploitation. Organizations using NGINX must review their infrastructure to assess exposure to this critical threat.

For those seeking detailed insights into the 18-year-old NGINX flaw, further information is accessible through the official news release. Read the full article here for a comprehensive analysis of the vulnerability and its impact.

https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html