CVE-2026-42945: NGINX Rewrite Module Vulnerability - What You Need to Know

A vulnerability identified as CVE-2026-42945 has been reported in the NGINX ngx_http_rewrite_module.

This issue affects specific NGINX configurations that use rewrite directives with unnamed PCRE captures such as $1 or $2, where the replacement string includes a question mark ?. Under certain conditions, an unauthenticated attacker may be able to send crafted HTTP requests that cause an NGINX worker process to crash. On systems where Address Space Layout Randomization (ASLR) is disabled, code execution may also be possible.

According to the official NGINX advisory, NGINX Open Source versions 0.6.27 through 1.30.0 are affected. Versions 1.30.1 and later and 1.31.0 and later are listed as not vulnerable.

Product	Branch	Vulnerable Version	Patched / Fixed Version	Severity	Vulnerable Component
NGINX Plus	37.x	None	37.0.0	High 8.1 / Critical 9.2	ngx_http_rewrite_module
NGINX Plus	R32 to R36	R32 to R36	R32 P6 / R36 P4	High 8.1 / Critical 9.2	ngx_http_rewrite_module
NGINX Open Source	1.x	1.0.0 to 1.30.0	1.30.1 / 1.31.0	High 8.1 / Critical 9.2	ngx_http_rewrite_module

Recommended Action

EuroVPS strongly recommends that all customers running NGINX verify their installed version and review their NGINX rewrite rules.

Check the installed NGINX version:

nginx -v

Check for rewrite rules using unnamed captures:

nginx -T 2>/dev/null | grep -nE 'rewrite[[:space:]].*\$[0-9]'

Update to a Patched NGINX Version

Update NGINX from the packages of your OS vendor, control panel vendor or F5; the fixed versions are in the table above.

Temporary Mitigation

If an immediate update is not possible, review any affected rewrite directives and replace unnamed captures such as $1 and $2 with named captures where applicable.

Example of a rewrite rule using an unnamed capture:

rewrite ^/user/([0-9]+)$ /profile.php?id=$1? last;

Example using a named capture:

rewrite ^/user/(?<userid>[0-9]+)$ /profile.php?id=$userid? last;

After making configuration changes, always validate and reload NGINX:

nginx -t
systemctl reload nginx

Plesk Servers

Plesk has confirmed that Plesk for Linux ships NGINX as part of its core installation and may be affected by CVE-2026-42945, depending on the installed NGINX version and rewrite rule configuration. The issue applies when rewrite rules reference unnamed regex captures such as $1, $2, and similar patterns.

Plesk states that NGINX versions below 1.31.1 mainline or 1.30.1 stable are vulnerable if affected rewrite rules are present. Plesk also notes that an updated NGINX package is expected through the official Plesk update channel.

For Plesk-managed servers, customers should apply the official Plesk update once available. EuroVPS does not recommend replacing the Plesk-provided NGINX package with unsupported third-party builds, as this may affect Plesk integration and future updates.

Product	Branch	Vulnerable Version	Patched / Fixed Version	Severity	Vulnerable Component
Plesk for Linux NGINX	Plesk-provided NGINX	Below 1.31.1 mainline or below 1.30.1 stable, if affected rewrite rules are present	Official Plesk NGINX update package	High 8.1 / Critical 9.2	ngx_http_rewrite_module

EuroVPS Recommendation

Also confirm ASLR is enabled: sysctl kernel.randomize_va_space should return 2.

Need Assistance?

If your server is managed by EuroVPS, open a support ticket and we will review and patch NGINX for you.

References

Plesk Advisory: CVE-2026-42945 in NGINX

F5 / NGINX Security Advisory for CVE-2026-42945

NVD CVE-2026-42945 Record