๐ฆ๐บiTNews AustraliaโขStalecollected in 2m
F5 patches 18-year-old Rift vulnerability found by AI
๐กAI discovered an 18-year-old critical NGINX bug. See how AI-driven security is auditing legacy code.
โก 30-Second TL;DR
What Changed
Vulnerability identified as a heap buffer overflow in the NGINX rewrite module.
Why It Matters
This highlights the critical role of AI in auditing legacy infrastructure. Organizations should prioritize updating NGINX instances to prevent potential exploitation of this long-standing flaw.
What To Do Next
Immediately update your NGINX instances to the latest patched version to secure your web infrastructure.
Who should care:Developers & AI Engineers
Key Points
- โขVulnerability identified as a heap buffer overflow in the NGINX rewrite module.
- โขThe security flaw remained undetected for 18 years before AI discovery.
- โขF5 has issued official patches to mitigate the Rift vulnerability.
- โขAI-assisted security scanning proves effective at finding legacy code vulnerabilities.
๐ง Deep Insight
Web-grounded analysis with 11 cited sources.
๐ Enhanced Key Takeaways
- โขThe vulnerability, tracked as CVE-2026-42945 and codenamed 'NGINX Rift', is a critical heap buffer overflow with a CVSS v4.0 score of 9.2.
- โขThe flaw specifically occurs in the
ngx_http_rewrite_modulewhen arewritedirective is followed by anotherrewrite,if, orsetdirective, and uses an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g.,$1,$2) with a replacement string containing a question mark (?). - โขThe AI-driven security analysis was performed by "depthfirst," an AI-native security company, whose platform autonomously identified this and three other remote memory corruption issues in NGINX within just six hours of scanning.
- โขExploitation can lead to remote code execution (RCE) on systems with Address Space Layout Randomization (ASLR) disabled, or a denial-of-service (DoS) by crashing the NGINX worker process on systems with ASLR enabled.
- โขA proof-of-concept (PoC) exploit for NGINX Rift has been publicly released, increasing the urgency for affected organizations to apply patches.
๐ ๏ธ Technical Deep Dive
- The vulnerability, identified as CVE-2026-42945 and codenamed NGINX Rift, is a heap buffer overflow within the
ngx_http_rewrite_moduleof NGINX. - It affects NGINX Open Source versions from 0.6.27 through 1.30.0, and NGINX Plus R32 through R36, among other F5 NGINX products.
- The flaw is triggered under specific configuration conditions: when a
rewritedirective is followed by arewrite,if, orsetdirective, and uses an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g.,$1,$2) with a replacement string that includes a question mark (?). - The root cause is a size-mismatch during NGINX's two-pass script engine processing of
rewriteandsetdirectives. In the first pass, NGINX calculates memory allocation, but if a question mark is present in the rewrite, an internalis_argsflag remains set. In the second pass, when copying data, characters like+and&expand during re-escaping, leading to a write past the allocated buffer. - This heap corruption can lead to a denial-of-service (DoS) by crashing the NGINX worker process. On systems where Address Space Layout Randomization (ASLR) is disabled, it can potentially lead to remote code execution (RCE) by corrupting adjacent memory pool structures and overwriting cleanup handler pointers.
- The vulnerability was autonomously discovered by the "depthfirst platform," an AI-powered source code analysis system, which identified four remote memory corruption issues in NGINX within six hours.
- F5 has released patches for NGINX Open Source (versions 1.30.1 and 1.31.0) and NGINX Plus (R32 P6, R35 P2, R36 P4).
- A temporary mitigation involves replacing unnamed PCRE captures with named captures in vulnerable rewrite rules to avoid the exploitable code path.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
AI-driven vulnerability discovery will become a standard practice in software development and security auditing.
The successful identification of an 18-year-old, critical flaw in widely used software like NGINX by an AI demonstrates its effectiveness in finding deeply embedded, complex bugs that human analysis missed, pushing for broader adoption.
The demand for specialized AI security tools and expertise will significantly increase, driving market growth.
The AI in cybersecurity market is already projected for substantial growth, and specific successes like 'Rift' will accelerate investment in AI platforms capable of autonomous vulnerability scanning and remediation.
Software vendors will increasingly integrate AI into their development lifecycle for proactive security, shifting from reactive patching.
The discovery highlights the limitations of traditional security methods for legacy codebases, prompting vendors to adopt AI earlier in the development process to prevent such long-standing vulnerabilities.
โณ Timeline
2004-10
NGINX initial public release.
2008
Vulnerability introduced in NGINX `ngx_http_rewrite_module` (version 0.6.27).
2011
NGINX, Inc. founded.
2019-03
F5 acquires NGINX, Inc. for $670 million.
2026-04-18
NGINX Rift vulnerability discovered by depthfirst AI.
2026-05-13
F5 releases security advisory and patches for CVE-2026-42945.
๐ Sources (11)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
๐ฐ
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: iTNews Australia โ