What it is: A heap buffer overflow in nginx's ngx_http_rewrite_module that went unnoticed for ~18 years, affecting nginx 0.6.27 through 1.30.0. CVSS 9.2.
Impact: Unauthenticated attackers can send crafted HTTP requests to crash nginx worker processes (reliable DoS). RCE is possible when ASLR is disabled on the host.
Mitigation: Patch to the latest Debian nginx package that includes the fix.
What it is: A critical NGINX vulnerability (CVE-2026-42945) that was disclosed last week is being exploited by attackers, according to VulnCheck. The vulnerability allows an attacker to crash the worker process or potentially execute arbitrary code.
Impact: The exploitation of this vulnerability can cause significant disruptions to affected systems, including worker crashes and potential remote code execution. This can lead to data corruption, system instability, or even complete system compromise.
Mitigation: To mitigate this vulnerability, administrators should apply the latest patch from the NGINX team, which is expected to be released soon. Additionally, disabling the vulnerable module or limiting the exposure of the vulnerable configuration can help reduce the attack surface.