NGINX Rift (CVE-2026-42945): How to Check and Update

What it is

CVE-2026-42945, known as NGINX Rift, is a buffer overflow in ngx_http_rewrite_module. The bug sat in the code for about eighteen years.

The vendor rates it medium, and that rating is worth reading correctly: it reflects how hard the flaw is to exploit, not the absence of risk. It has been used in real attacks since its disclosure in May 2026, so upgrade regardless of the severity label.

Who is affected

Builds that use the rewrite module are affected, which means almost all of them: the rewrite, return, and if directives are part of the standard distribution. Configurations that combine alias with rewrite, and configurations that use unnamed capture groups in regular expressions, are at particular risk.

Fixed versions

If you updated after October 2026, you most likely have 1.30.6 or 1.31.7, which contain this fix and later ones.

How to check your version

nginx -v
nginx -V 2>&1 | tr ' ' '\n' | grep -E 'with-http_(v3|slice)'

The second command shows whether your build includes HTTP/3 and the slice module. You need this to assess the other vulnerabilities in the same set.

You can also see the version from outside, if it is not hidden:

curl -sI https://your-site/ | grep -i '^server'

Updating on Ubuntu and Debian

sudo apt update
sudo apt install --only-upgrade nginx
nginx -t && sudo systemctl reload nginx

The nginx -t command is required: it validates the configuration before the reload. Reloading with reload does not drop current connections, so there is no downtime.

Updating on AlmaLinux and RHEL

sudo dnf update nginx
nginx -t && sudo systemctl reload nginx

If nginx was installed from the official nginx.org repository, make sure that repository is enabled. Packages from it are updated separately from the system packages.

Temporary measures if you cannot update

The vendor advises replacing unnamed capture groups in regular expressions with named ones and not combining alias with rewrite. An example of a safe form:

location ~ ^/files/(?<path>.+)$ {
    root /var/www/storage;
    try_files /$path =404;
}

This narrows the attack surface but does not replace the update.

Frequently asked questions

Is nginx vulnerable to CVE-2026-42945 when it runs as a reverse proxy?

Yes, if the rewrite module is used. The role of the server does not matter.

Do I need to restart nginx after updating, or is reload enough?

reload is enough: it starts new worker processes with the new code and gracefully shuts down the old ones.

How do I check that the old nginx worker processes have exited?

ps -eo lstart,cmd | grep 'nginx: worker' | head

The start time of all processes should be recent.