Multiple Vulnerabilities in NGINX Could Allow for Remote Code Execution

Executive Summary

MS-ISAC Advisory 2026-051 (issued 5/18/2026): multiple vulnerabilities in NGINX, the most severe of which could allow for remote code execution. Issues include a heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945), an excessive memory allocation issue in ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), a use-after-free in ngx_http_ssl_module (CVE-2026-40701), and an out-of-bounds read in ngx_http_charset_module (CVE-2026-42934). A proof-of-concept exploit has been published by DepthFirst, and VulnCheck reported CVE-2026-42945 has been exploited in the wild.

Municipal Impact

MS-ISAC rates the risk as High for large and medium government entities and Medium for small government entities; municipal web infrastructure using NGINX should be patched urgently.

SMB Impact

MS-ISAC rates the risk as High for large and medium business entities, Medium for small business entities, and Low for home users.

Recommended Actions

1. Apply appropriate updates provided by F5 or other vendors which use this software to vulnerable systems immediately after appropriate testing.
2. Prioritize remediation of CVE-2026-42945, which is being exploited in the wild.
3. Follow CIS Safeguards for vulnerability management, automated vulnerability scanning, and remediation.

Grey Matter Analysis