CVE-2026-42945, a critical heap buffer overflow in NGINX's ngx_http_rewrite_module introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives.
Affected Versions:
• NGINX Open Source: 0.6.27 – 1.30.0
• NGINX Plus: R32 – R36
