---
id: 5436
title: "[CVE-2026-42945] NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability"
cve: CVE-2026-42945
source_domain: depthfirst.com
source_url: "https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability"
published_at: "2026-05-13T12:00:00Z"
tags: ["rce", "vulnerability-research", "memory-corruption", "heap-overflow", "nginx", "cve-2026-42945"]
phying_url: "https://phying.com/item/5436"
lang: en
---

# [CVE-2026-42945] NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability

## Summary

depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.

## Intelligence Metadata

- **Sources:** depthfirst.com
- **CVE:** CVE-2026-42945
- **Published:** 2026-05-13T12:00:00Z
- **Original:** https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability
- **Phying News:** https://phying.com/item/5436