Hackers Quickly Exploit Critical NGINX Vulnerability

Cybercriminals are swiftly taking advantage of a recently exposed critical vulnerability in NGINX. Security analysts have already detected ongoing real-world assaults, mere days following the vulnerability’s public disclosure.

Threat Actors Targeting NGINX

Patrick Garrity, a security expert from VulnCheck, has identified active targeting of CVE-2026-42945 by cyber threats. This flaw, a heap buffer overflow, impacts both NGINX Open Source and NGINX Plus.

The swift transition from disclosure to exploitation underscores the speed at which attackers leverage newly uncovered vulnerabilities.

Details of the Exploitation

VulnCheck’s Initial Access team reports that this vulnerability permits unauthenticated attackers to crash NGINX worker processes through specially crafted HTTP requests.

Although this can lead to denial-of-service (DoS) conditions, the risk heightens under certain configurations where Address Space Layout Randomization (ASLR) is disabled, potentially allowing remote code execution (RCE).

However, such scenarios are relatively rare, as ASLR is generally enabled by default across most systems today.

Potential Impact and Mitigation

Exploitation requires a specific NGINX rewrite configuration, meaning not all NGINX servers are at risk, thus reducing the attack surface. Still, potential exposure is significant.

VulnCheck’s Patrick Garrity, in a LinkedIn post, stated that Censys data shows approximately 5.7 million internet-facing NGINX servers might run vulnerable versions. While only some may meet exploitation criteria, the sheer number highlights the necessity for prompt patching.

The rapid exploitation of this vulnerability indicates that attackers are scanning for unpatched or misconfigured servers, often linked to opportunistic threats seeking initial access before defenses are strengthened.

Given NGINX’s widespread use as a web server, reverse proxy, and load balancer, a successful attack could disrupt services or lead to deeper system compromises.

Security professionals strongly recommend that organizations examine their NGINX configurations and apply necessary patches immediately. Ensuring security features like ASLR are enabled and auditing rewrite rules can protect against this flaw.

This incident exemplifies a growing cybersecurity challenge: the decreasing time between vulnerability disclosure and exploitation. Organizations that delay patching even briefly may become vulnerable. As threat actors continue automating scanning and exploitation, proactive vulnerability management is essential for defending against emerging cyber threats.