ARargee·May 14, 2026
In New Nginx ExploitDepthFirstDisclosures
Nginx-Rift
Python2026–2026
DepthFirstDisclosures / Nginx-Rift
Nginx-Rift
NGINX RCE exploits
4Distinct people
5Mentions
0Explicit recommenders
932GitHub stars
What to know before exploring
What it is
NGINX RCE exploits
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by hour5 dated mentions
Observed mentions: 2026-05-13 19:28:38 UTC to 2026-05-14 17:42:56 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| May 13, 19:00 | 2026-05-13 19:00:00 UTC | 2026-05-13 20:00:00 UTC | 1 | 1 | 0 |
| May 13, 20:00 | 2026-05-13 20:00:00 UTC | 2026-05-13 21:00:00 UTC | 0 | 0 | 0 |
| May 13, 21:00 | 2026-05-13 21:00:00 UTC | 2026-05-13 22:00:00 UTC | 0 | 0 | 0 |
| May 13, 22:00 | 2026-05-13 22:00:00 UTC | 2026-05-13 23:00:00 UTC | 0 | 0 | 0 |
| May 13, 23:00 | 2026-05-13 23:00:00 UTC | 2026-05-14 00:00:00 UTC | 0 | 0 | 0 |
| May 14, 00:00 | 2026-05-14 00:00:00 UTC | 2026-05-14 01:00:00 UTC | 0 | 0 | 0 |
| May 14, 01:00 | 2026-05-14 01:00:00 UTC | 2026-05-14 02:00:00 UTC | 0 | 0 | 0 |
| May 14, 02:00 | 2026-05-14 02:00:00 UTC | 2026-05-14 03:00:00 UTC | 0 | 0 | 0 |
| May 14, 03:00 | 2026-05-14 03:00:00 UTC | 2026-05-14 04:00:00 UTC | 0 | 0 | 0 |
| May 14, 04:00 | 2026-05-14 04:00:00 UTC | 2026-05-14 05:00:00 UTC | 0 | 0 | 0 |
| May 14, 05:00 | 2026-05-14 05:00:00 UTC | 2026-05-14 06:00:00 UTC | 0 | 0 | 0 |
| May 14, 06:00 | 2026-05-14 06:00:00 UTC | 2026-05-14 07:00:00 UTC | 0 | 0 | 0 |
| May 14, 07:00 | 2026-05-14 07:00:00 UTC | 2026-05-14 08:00:00 UTC | 0 | 0 | 0 |
| May 14, 08:00 | 2026-05-14 08:00:00 UTC | 2026-05-14 09:00:00 UTC | 0 | 0 | 0 |
| May 14, 09:00 | 2026-05-14 09:00:00 UTC | 2026-05-14 10:00:00 UTC | 0 | 0 | 0 |
| May 14, 10:00 | 2026-05-14 10:00:00 UTC | 2026-05-14 11:00:00 UTC | 0 | 0 | 0 |
| May 14, 11:00 | 2026-05-14 11:00:00 UTC | 2026-05-14 12:00:00 UTC | 0 | 0 | 0 |
| May 14, 12:00 | 2026-05-14 12:00:00 UTC | 2026-05-14 13:00:00 UTC | 0 | 0 | 0 |
| May 14, 13:00 | 2026-05-14 13:00:00 UTC | 2026-05-14 14:00:00 UTC | 0 | 0 | 0 |
| May 14, 14:00 | 2026-05-14 14:00:00 UTC | 2026-05-14 15:00:00 UTC | 0 | 0 | 0 |
| May 14, 15:00 | 2026-05-14 15:00:00 UTC | 2026-05-14 16:00:00 UTC | 0 | 0 | 0 |
| May 14, 16:00 | 2026-05-14 16:00:00 UTC | 2026-05-14 17:00:00 UTC | 0 | 0 | 0 |
| May 14, 17:00 | 2026-05-14 17:00:00 UTC | 2026-05-14 18:00:00 UTC | 4 | 1 | 3 |
What Hacker News says
5 sourcesThe POC disables aslr: https://github.com/DepthFirstDisclosures/Nginx-Rift/blob/mai...
In New Nginx ExploitJust saw this pop up — full public PoC for CVE-2026-42945 ("NGINX Rift"), a heap buffer overflow in NGINX's ngx_http_rewrite_module that's been there since 0.6.27 (2008).
It triggers on a very common pattern: a `rewrite` directive (with an unnamed capture like $1/$2 and a `?` in the replacement string) followed by `set`, `if`, or another `rewrite`. The root cause is a classic two-pass script engine bug (length calculation vs. actual copy pass with ngx_escape_uri).
The PoC turns it into unauthenticated RCE using cross-request heap feng shui + pool cleanup pointer corruption. Tested with a simple Docker setup.
- Repo + Python exploit: https://github.com/DepthFirstDisclosures/Nginx-Rift
- Full technical write-up: https://depthfirst.com/research/nginx-rift-achieving-nginx-r...
- F5 advisory + patches (1.31.0 / 1.30.1 for OSS, plus Plus update
Read the rest
s): https://my.f5.com/manage/s/article/K000160932 (or the latest K000161019)
Affects basically any NGINX doing URL rewriting in front of apps/PHP/etc. Workaround mentioned is switching to named captures.
The discovery angle is also interesting — it was found autonomously by depthfirst's security analysis tool after one-click onboarding of the NGINX source.
Anyone running NGINX in production using rewrite rules? How are you checking your configs? Thoughts on the exploit chain or the AI-assisted finding process?
CVE-2026-42945 – Critical heap buffer overflow in Nginx ngx_HTTP_rewrite_module
5 points · Open discussion