Skip to content
Weekly Signal
Live intelligence Updated 21 Aug 2026 · 22:12 UTC

F5 · Dos, Nginx Gateway Fabric, Nginx Ingress Controller +4 more

CVE-2026-42945

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive i...

Recommended action

Handle this through the normal risk-based patching cycle while monitoring for change. F5 Security advisory K000161019

View response plan
CVSS9.2
EPSS66.0%
KEVNo
ExploitationNone
RemediationMitigation available ↓

Assessment

Why it matters

EPSS is 66.0%; technical severity is CVSS 9.2.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Who should care

  • Teams operating Dos, Nginx Gateway Fabric, Nginx Ingress Controller +4 more
  • Vulnerability and exposure management teams
  • Security operations teams monitoring exploitation activity

Response plan

What I would do

  1. Confirm whether Dos, Nginx Gateway Fabric, Nginx Ingress Controller +4 more is present in the environment.
  2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
  3. F5 Security advisory K000161019
  4. Review relevant security telemetry for evidence of attempted or successful exploitation.
  5. Document the remediation decision and track it to verified completion.

Treatment intelligence

Remediation intelligence

Not yet verified

Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.

Verification noteAutomated link verification has not completed for this guidance yet.

Mitigation

Advisory

Technical details

CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-122
Affected versions
F5 Dos (Start Including 4.3.0, End Including 4.7.0 | Version 4.8.0); F5 Nginx Gateway Fabric (Start Including 1.3.0, End Including 1.6.2 | Start Including 2.0.0, End Including 2.5.1); F5 Nginx Ingress Controller (Start Including 3.5.0, End Including 3.7.2 | Start Including 4.0.0, End Including 4.0.1 | Start Including 5.0.0, End Including 5.4.1); F5 Nginx Instance Manager (Start Including 2.16.0, End Including 2.21.1); F5 Nginx Open Source (Start Including 0.6.27, End Including 1.30.0); F5 Nginx Plus (Start Including r32, End Including r36); F5 Waf (Start Including 4.9.0, End Including 4.16.0 | Start Including 5.1.0, End Including 5.8.0 | Start Including 5.9.0, End Including 5.12.1)
Fixed versions
No explicit fixed version is currently recorded.
Published
13 May 2026
Attack vector
Network
Privileges required
None
User interaction
None

Signal timeline

  1. CVE published
  2. Latest EPSS score: 66.0%
  3. Signal calculated at 29

External references

Live public intelligence This assessment combines public-source evidence. Validate the affected product, version and exposure against your own environment before making a risk decision.