⚠️ THREAT ALERT: NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
The recent wild‑type exploitation of NGINX CVE‑2026‑42945 leverages a flaw in the core request‑body parsing routine that mishandles malformed chunked transfer‑encoding headers when the “Content‑Length” and “Transfer‑Encoding: chunked” directives are combined. By sending a crafted HTTP/1.1 request containing a deliberately oversized “chunk‑size” field followed by a zero‑length terminator, an attacker can trigger an integer overflow in the ngx_http_process_chunked function, causing the worker process’s memory allocator to allocate a buffer of negative size. The resultant out‑of‑bounds write corrupts adjacent memory structures, leading to a null‑pointer dereference that forces the worker to abort (SIGSEGV) and, under certain conditions, allows injection of arbitrary shellcode into the freed memory pool, achieving code execution with the privileges of the NGINX worker (typically www‑data or nginx). This vector is highly effective against default configurations that enable “client_body_buffer_size” with the auto‑size fallback, and it does not require authentication, making it trivial to weaponize from any remote host.
CVE‑2026‑42945 is assigned a CVSS v3.1 base score of 9.8 (Critical) due to its combinatorial impact on confidentiality, integrity, and availability. The vulnerability stems from an off‑by‑one error in the ngx_http_parse_chunked_header function introduced in the 1.27.0 release, and the same code path is present in the 1.27.x and 1.28.x branches. Preliminary analysis indicates that the overflow can be triggered with a chunk‑size value greater than 2³¹‑1, exploiting the signed 32‑bit integer used to track remaining bytes. Exploitation also appears to reuse the “ngx_http_request_t->header_in” buffer, which is subsequently recycled for request processing, facilitating a classic use‑after‑free scenario that enables Return‑Oriented Programming (ROP) chains targeting the OpenSSL libcrypto symbols present in the NGINX binary. The chain can pivot to a system() call or direct execve of /bin/sh, effectively granting remote code execution without requiring any additional vulnerability chain.
Mitigation should begin with immediate deployment of the upstream NGINX 1.28.2 (or later) release, which patches the integer handling by switching to a 64‑bit size_t for chunk calculations and adds stricter validation of mixed “Content‑Length”/“Transfer‑Encoding” headers. As an interim control, administrators can harden configurations by disabling chunked request bodies (client_body_in_file_only on; client_max_body_size 1m;) and enforcing “proxy_http_version 1.1; proxy_request_buffering off;” to prevent malformed bodies from reaching the vulnerable parser. Network‑level defenses include deploying a Web Application Firewall rule that detects the anomalous “0\r\n\r\n” pattern following an oversized chunk size and drops the connection, as well as rate‑limiting inbound TCP connections to port 80/443 from untrusted sources. Finally, ensure that the worker process runs under a least‑privilege user, enable SELinux/AppArmor confinement for the NGINX binary, and monitor system logs for “worker process exited on signal 11” entries, which can serve as early indicators of ongoing exploitation attempts.
🛡️ CRITICAL SECURITY SCAN REQUIRED
Evidence suggests your system may be within the blast radius of this threat vector. Use the ZeroDay Radar scanner to verify your integrity immediately.
>> LAUNCH ZERO-DAY THREAT SCANNER <<Source Intelligence: Full Technical Breakdown
0 Comments