18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE (thehackernews.com)
from eager_eagle@lemmy.world to selfhosted@lemmy.world on 14 May 13:41
https://lemmy.world/post/46851451

Update your nginx instances

cross-posted from: lemmy.world/post/46851448

Affected an non-affected versions nginx.org/en/security_advisories.html
CVE record www.cve.org/CVERecord?id=CVE-2026-42945
CVE details nvd.nist.gov/vuln/detail/CVE-2026-42945
PoC github.com/DepthFirstDisclosures/Nginx-Rift

CVE - Common Vulnerabilities and Exposures system
RCE - Remote Code Execution
PoC - Proof of Concept

#selfhosted

threaded - newest

cheesemoo@lemmy.world on 14 May 17:28 next collapse

For anyone else using SWAG, it looks like a fix is on its way but not available yet. This SWAG issue points to an upstream Alpine package dependency that needs to be updated first. Looking at the source, they just recently committed backported patches, so presumably a new version will be released soon; then the SWAG image can be updated.

K3can@lemmy.radio on 14 May 19:17 next collapse

Seems to be specific to rewrites using an un-named capture.

grep -rnE “\$[0-9.*].*\?” /etc/ngnix

should show if you have any potentially vulnerable directives in your config.

Lemmchen@feddit.org on 14 May 19:27 next collapse

I have an old Debian 11 “bullseye” installation running on one of my servers. It’s stuck at nginx 1.18.0, but it should theoretically still be covered by Debian 11 LTS security updates, right? wiki.debian.org/LTS/Using
nginx/oldoldstable-security,now 1.18.0-6.1+deb11u5

forbiddenlake@lemmy.world on 15 May 02:25 collapse

Probably yeah security-tracker.debian.org/…/CVE-2026-42945

skankhunt42@lemmy.ca on 14 May 20:38 next collapse

It’s days like this where I’m happy I’m unemployed. I have a group chat with a few friends and they’re pushing out patches and it’s a bit of a rush.

All my publicly accessible servers update every 6 hours and reboot after whenever they need to. It’s rare I need to step in and fix something. I checked a few hours ago and I’m not at risk.

GreenKnight23@lemmy.world on 15 May 04:00 collapse

All my publicly accessible servers update every 6 hours and reboot after whenever they need to. It’s rare I need to step in and fix something. I checked a few hours ago and I’m not at risk.

not the flex you think it is.

didn’t npm have a worm problem a few days ago?

skankhunt42@lemmy.ca on 15 May 09:26 collapse

Yep. I wasn’t affected thankfully. Didn’t realise I was flexing, sorry. Just happy most of my stack is automated and it’s quite low maintenance at this point.

Where do I draw the line then? Serious question. If updating every couple hours is bad, then what’s safe?

GreenKnight23@lemmy.world on 15 May 09:50 collapse

for corporate services we do every 30 days. which is standard. emergency patches get direct support and resolved quickly.

Decronym@lemmy.decronym.xyz on 15 May 02:30 collapse

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
HTTP	Hypertext Transfer Protocol, the Web
LTS	Long Term Support software version
nginx	Popular HTTP server

2 acronyms in this thread; the most compressed thread commented on today has 17 acronyms.

[Thread #290 for this comm, first seen 15th May 2026, 02:30] [FAQ] [Full list] [Contact] [Source code]