F5 has issued emergency patches for CVE-2026-42945, a critical heap buffer overflow vulnerability within the NGINX rewrite module, known as "NGINX Rift." Discovered through AI-driven LLM grounding, this flaw has persisted in legacy code for approximately 18 years. The vulnerability enables unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS) by exploiting specific 'rewrite' rule syntax. Given NGINX's ubiquity as a reverse proxy, API gateway, and edge load balancer, the attack surface is massive, posing a significant risk of complete system compromise and service disruption for critical internet-facing infrastructure.

• Vulnerability Mechanics: The 'NGINX Rift' Flaw
  • Root cause is a heap buffer overflow residing within the legacy NGINX rewrite module components.
  • The vulnerability is triggered through specific, malformed 'rewrite' rule syntax during request processing.
  • This critical flaw has persisted undetected in the NGINX source code for approximately 18 years.
  • Technical artifacts include specific heap buffer overflow exploit primitives and PoC vectors for unauthenticated RCE.
• Impact and Exploitation Status
  • Severity is rated as Critical, facilitating both unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS).
  • Primary target surface includes ubiquitous NGINX-based reverse proxies, API gateways, and edge load balancers.
  • Compromise carries a high probability of complete system takeover and significant operational disruption.
  • Attackers can leverage the flaw to gain full control over high-volume, internet-facing traffic handlers.
• Discovery Methodology: AI-Driven Research
  • Discovered via AI/LLM grounding, representing a significant evolution in automated vulnerability discovery.
  • CSA Labs spearheaded the research, demonstrating the efficacy of LLMs in identifying deep-seated legacy bugs.
  • Findings were corroborated by multiple industry research firms including Fieldeffect, Beazley, and XM Cyber.
  • The discovery highlights a new frontier for uncovering long-dormant vulnerabilities in massive codebases.
• Detection and Mitigation Strategies
  • F5 has released emergency patch diffs to remediate the vulnerable NGINX rewrite module distributions.
  • Immediate remediation via emergency patching is required across all global edge infrastructure.
  • Security teams should inspect NGINX configurations for specific 'rewrite' rule patterns known to trigger the overflow.
  • Continuous monitoring for unexpected service instability or unauthorized access attempts on edge assets is critical.