What is nginx-rift?

NGINX Rift is a proof of concept exploit for CVE-2026-42945, a critical security flaw in NGINX's rewrite module that had existed in the code since 2008. The bug allows an attacker to remotely execute code on a vulnerable server without needing to log in, as long as the server configuration uses the rewrite or set directives. It was found, along with three related memory corruption bugs, by an automated security analysis system from a company called depthfirst after it was pointed at the NGINX source code. The root cause is a mismatch inside NGINX's script engine, which calculates how much memory a buffer needs in one pass and then copies data into that buffer in a second pass. A flag called is_args controls whether special characters get expanded during copying, but that flag is set differently between the two passes, so the size calculated in the first pass ends up smaller than what actually gets written in the second pass. This creates a heap buffer overflow using attacker controlled data from the request URI. The proof of concept uses a technique that carefully arranges memory across several requests to corrupt a nearby memory structure, redirecting a cleanup pointer so that it runs a shell command when that structure is later destroyed. The README lists exactly which versions are affected and which versions contain the fix, covering both NGINX Open Source and NGINX Plus, and links to the official vendor advisory for full details. It also links to a longer technical write up describing the vulnerability in depth. To try the proof of concept, the README explains you first run a setup script to build a container, then start a deliberately vulnerable NGINX server with Docker Compose, and finally run a Python script with a shell flag to demonstrate code execution. It was tested on Ubuntu 24.04. The project is written in Python and does not state a license.