NGINX Rift and Fragnesia: Two Critical Flaws at the Heart of…

An 18-year-old heap overflow hits nearly 19 million NGINX servers with unauthenticated RCE, while a local Linux exploit corrupts the page cache to gain root — both discovered with AI assistance, signaling a collapse in vulnerability incubation time.

An unauthenticated remote vulnerability that lay dormant for 18 years in the world's most widely deployed web server, and a local Linux kernel exploit that corrupts the page cache to obtain root: in the second week of May 2026, internet infrastructure suffered a double fracture. The coincidence is not accidental. Both flaws were discovered with AI assistance, confirming that the incubation period for long-lived vulnerabilities — bugs that sleep in code for years or decades — is collapsing from a multi-year horizon to months or weeks. The risk calculus for anyone managing priority patching changes structurally.

Key Takeaways

CVE-2026-42945, dubbed NGINX Rift, is a heap buffer overflow in the NGINX rewrite module present since 2008 with CVSS 9.2; it enables unauthenticated RCE with a single HTTP request
F5 Networks released patches on May 13, 2026 after responsible disclosure on April 21, 2026; versions 0.6.27-0.9.7 will not receive fixes
Fragnesia, discovered by William Bowling, exploits the Linux kernel's XFRM ESP-in-TCP subsystem to corrupt the page cache of readable files and escalate privileges to root
DepthFirst AI automatically identified four memory corruption vulnerabilities in NGINX — including Rift — by loading the source code into its analysis system once

NGINX Rift: 18 Years of Latency, One Request to Compromise the Server

On April 21, 2026, depthfirst researchers delivered responsible disclosure of a vulnerability in the ngx_http_rewrite_module to F5 Networks. On May 13, 2026, F5 distributed patches. According to the vendor advisory, the flaw manifests when a rewrite directive is followed by set, rewrite, or if with an unnamed PCRE capture — such as $1, $2 — and a replacement string containing the ? character.

The mechanism is a phase mismatch. In the first phase, the rewrite engine calculates buffer size by allocating space for special characters in decoded form. In the second phase, it copies bytes from the original URI. When a character like ? in URL encoding occupies three bytes instead of one, the copy exceeds the allocation: a controlled heap overflow. The bytes beyond the limit derive from the attacker's URI, so the corruption is shaped, not random.

According to depthfirst, quoted by The Hacker News: "An attacker who can reach a vulnerable NGINX server over HTTP can send a single request that overflows the heap in the worker process and achieves remote code execution. There is no authentication step, no prior access requirement, and no need for an existing session." The same source notes that "the bytes written past the allocation are derived from the attacker's URI, so the corruption is shaped by the attacker rather than random."

The public PoC on GitHub combines the overflow with an LFI/arbitrary-file-read primitive on the same host to bypass ASLR. The base exploit requires ASLR disabled; the advanced chain that bypasses ASLR is more complex. No confirmation of active in-the-wild exploitation has emerged at this time.

"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module... when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?)" — F5 Networks advisory

The Attack Surface: Nearly 19 Million Instances, Many Unpatched

According to Rod Trent, author of the original Substack newsletter, approximately 19 million NGINX instances are exposed worldwide. The number is not independently verifiable from available sources, but the web server's ubiquity — used as a reverse proxy, load balancer, and Kubernetes ingress controller — makes a multi-million order of magnitude plausible.

Affected NGINX Open Source versions range from 0.6.27 to 1.30.0; fixes arrive in 1.30.1 and 1.31.0. F5 explicitly stated that versions 0.6.27 through 0.9.7 will not receive fixes. NGINX Plus is vulnerable from releases R32 through R36; patches are R32 P6 and R36 P4. Concurrently, F5 fixed three other vulnerabilities: CVE-2026-42946 (CVSS 8.3), CVE-2026-40701 (CVSS 6.3), and CVE-2026-42934 (CVSS 6.3).

According to the NVD, the official CVSS for CVE-2026-42945 is 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Rod Trent reports CVSS 9.2 instead. The discrepancy remains unresolved in the dossier; both numbers are attributed to their respective sources. The Italian source ilsoftware.it corroborates the heap overflow mechanism with additional technical analysis, confirming versions and timelines.

Fragnesia: Corrupting the Kernel Page Cache to Become Root

Alongside Rift, researcher William Bowling published Fragnesia: a local Linux kernel exploit that exploits the XFRM ESP-in-TCP subsystem, involving the esp4, esp6, and rxrpc modules. The path is unusual. The exploit manipulates socket buffer handling via skb_try_coalesce() and splicing primitives to corrupt the page cache of files readable by an unprivileged user — such as /usr/bin/su or /etc/passwd.

Once the page cache content is corrupted, Fragnesia chains to root privileges via in-place AES-GCM decryption on spliced page cache fragments. The PoC is public on GitHub. Patches are rolling out on AlmaLinux, Fedora, and Ubuntu, but the dossier does not specify exact kernel versions or definitive timelines. The CVE is not mentioned in available sources; no CVSS is reported.

The threat is highest in multi-tenant cloud and container environments, where privilege isolation is the fundamental security boundary. A container breakout via Fragnesia would compromise the entire node. Rod Trent cites "Microsoft and others" among those recommending mitigations, but the dossier does not identify specific Microsoft advisories.

What to Do Now

Check for rewrite directives followed by set/rewrite/if with PCRE captures and a ? character in the replacement string: this configuration activates the NGINX Rift attack surface
Upgrade to NGINX Open Source 1.30.1 or 1.31.0, or to NGINX Plus R32 P6 / R36 P4, within the priority patching window; versions 0.6.27-0.9.7 require forced migration
For Fragnesia, monitor the Linux kernel patch rollout on your distribution and verify the status of the esp4, esp6, rxrpc modules; where applicable, consider disabling unnecessary modules
Audit the use of AI-assisted code review in your development cycle: DepthFirst AI's discovery of four vulnerabilities in a single NGINX source load indicates the offensive-defensive competition has shifted to automated analysis speed

Why AI Is Redrawing the Risk Calendar

The real news is not the individual severity of Rift or Fragnesia, both documented flaws with patches available. It is the systemic pattern: two long-lived vulnerabilities in mature code — the Linux kernel, NGINX — discovered in the same window using AI-assisted methodologies. DepthFirst AI found four memory corruption bugs by loading the NGINX source once. The incubation period, that window where a bug exists undiscovered, has shortened drastically.

For infrastructure operators, this means the risk model based on code "age" loses predictive validity. Code that withstood decades of human audit can be revealed vulnerable in weeks by automated tools. Priority patching must therefore be redefined: no longer a hierarchy by software seniority, but by exposed footprint criticality and attacker velocity. The May 2026 double fracture is a wake-up call, not an exception.

Information verified against cited sources and current as of publication.

Sources

Sources and references