nginx-cve-2026-42945

[dcasota]

Describe the bug

Hi,

The Photon OS nginx server is likely within the affected version range for CVE-2026-42945 (nginx Rift).

Version check

• Affected range: NGINX Open Source 0.6.27 → 1.30.0
• vmwarecna/nginx ships: nginx 1.7.11
• 1.7.11 falls squarely inside that range. The bug was introduced in 2008 (~0.6.27) and only fixed in 1.30.1 / 1.31.0. So the code-level flaw is present in this image.

The vulnerable code is in ngx_http_rewrite_module, which is compiled into nginx by default, so the module is definitely present in the 1.7.11 build.

Reproduction steps

Please review the following prepared PRs and let me know whether they provide any benefit.

• master branch: nginx: upgrade to v1.30.1 to fix CVE-2026-42945 dcasota/photon#15
• 4.0 branch: nginx: fix CVE-2026-42945 (heap buffer overflow in rewrite module) dcasota/photon#16
• 5.0 SPECS/91 branch: nginx: fix CVE-2026-42945 and co-disclosed CVEs on Photon OS 5.0 dcasota/photon#17
• 5.0 branch: nginx: upgrade to v1.30.1 to fix CVE-2026-42945 and co-disclosed CVEs dcasota/photon#18

Expected behavior

patches for CVE-2026-42945 done.

Additional context

#1654 From a risk perspective, crafting co-disclosed CVEs into custom backports is usually a safe option. A version bump is "easier" if the risks are well-known.

 Summary by risk

  ┌──────────────────────────────────┬────────────┬─────────┬───────────────────┬─────┐
  │              Change              │    4.0     │ 5.0 ≤91 │      5.0 ≥92      │ 6.0 │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ TLSv1/1.1 disabled               │ ●          │ ●       │ already in 1.28.x │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ proxy_http_version 1.1 default   │ ●          │ ●       │ ●                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ upstream keepalive on by default │ ●          │ ●       │ ●                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ Chunked LF-only rejected         │ ●          │ ●       │ ●                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ RFC 3986 host validation         │ ●          │ ●       │ ●                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ njs 0.9.0 String API removal     │ ● (static) │ ●       │ —                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ njs 0.8.5 binary/UTF-8 split     │ ●          │ ●       │ —                 │ ●   │
  ├──────────────────────────────────┼────────────┼─────────┼───────────────────┼─────┤
  │ TLSv1.3 cert compression off     │ ●          │ ●       │ ●                 │ ●   │
  └──────────────────────────────────┴────────────┴─────────┴───────────────────┴─────┘

The 4.0 spec uses --add-module=njs-... (static) rather than --add-dynamic-module. With njs compiled into the nginx binary, any njs config script using the removed String methods or the old binary encoding API will cause nginx to fail to load the configuration on startup - there is no way to unload a static module at runtime. This is a harder failure mode than on 5.0/6.0 where the njs .so can simply not be loaded.

The two changes most likely to cause silent regressions in production are the proxy keepalive default and the proxy_http_version 1.1 default - both in 1.29.7 - since they alter outbound connection behaviour without any warning in nginx error logs.

[dcasota]

Per-branch status — CVE-2026-42945 is fixed in nginx ≥ 1.30.1. Current nginx version on each affected branch/variant (nginx.spec):

Branch / variant	nginx (current)	Status
5.0 — SPECS/nginx (subrelease ≥ 92; also used by 91)	1.30.2	✅ fixed
5.0 — SPECS/90/nginx (subrelease 90)	1.26.3	❌ still affected — proposed fix: dcasota#20
4.0 — SPECS/nginx	1.26.3	❌ still affected — proposed fix: dcasota#16
6.0 — SPECS/nginx	1.26.3	❌ still affected — proposed fix: dcasota#18
master / dev — SPECS/nginx	1.27.1	❌ still affected — proposed fix: dcasota#15

Notes:

• 5.0 SPECS/91/nginx does not exist, so subrelease-91 of 5.0 falls back to the default SPECS/nginx (1.30.2 — fixed).
• 5.0's default (≥ 92) and 91 are fixed; 5.0 SPECS/90, 4.0, 6.0, and master/dev remain affected, each with a proposed fix linked above.

This issue should stay open until those remaining variants are also updated to ≥ 1.30.1.