The 18-year-old NGINX rewrite module vulnerability, tracked as CVE-2026-42945 and named “NGINX Rift,” is a serious reminder that even mature, widely deployed infrastructure can hide critical flaws for years. The issue affects the ngx_http_rewrite_module and can allow a remote unauthenticated attacker to trigger a heap buffer overflow through crafted HTTP requests, leading to denial of service and, in some conditions, remote code execution.

Organizations using NGINX should urgently review exposed instances, check whether vulnerable rewrite configurations are in use, and upgrade to fixed versions such as NGINX Open Source 1.30.1 or 1.31.0 where applicable. If patching is delayed, affected rewrite rules should be reviewed and unnamed captures replaced with named captures as recommended. This is exactly why “it has been running fine for years” is not a security strategy; it is just optimism wearing a sysadmin badge.

Cybersecurity researchers have disclosed multiple security vulnerabilities impacting NGINX Plus and NGINX Open, including a critical flaw that remained undetected for 18 years. The vulnerability, discovered by depthfirst, is a heap buffer overflow issue impacting ngx_http_rewrite_module (CVE-2026-42945, CVSS v4 score: 9.2) that could allow an attacker to achieve remote code execution or cause a

Source: 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE via The Hacker News — published 14 May 2026.