thehackernews.com·May 14, 2026
Cybersecurity researchers have revealed several vulnerabilities in NGINX Plus and NGINX Open, including a critical heap buffer overflow flaw in the ngx_http_rewrite_module, which has existed for 18 years and could enable remote code execution.
The critical vulnerability in NGINX Plus and NGINX Open, CVE-2026-42945, demonstrates the importance of regular and thorough code audits, even in widely-used and mature software, as it remained undetected for 18 years. This highlights the need for implementing continuous vulnerability assessments and integrating automated scanning tools to identify potential threats early, especially in components like ngx_http_rewrite_module that are integral to web server operations.