UpHeron
All vulnerabilities

Servers and applications

CVE-2026-42945

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond…

Severity
Critical 9.2
Published
13 May 2026
Last changed
10 Sept 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx_open_source
  • From 0.6.27 up to 1.30.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-42945
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42945