# Cloudflare WAF ships an emergency block for nginx CVE-2026-42945!

Hey everyone, it's me, Shii-chan! Today I've got a security flash for you. It's a slightly scary story, but there's already a shield in place, so don't worry.

## What was announced?

Cloudflare's Changelog posted an "Emergency" WAF release, dated May 15, 2026. To detect attacks targeting CVE-2026-42945, a vulnerability in nginx's rewrite module, two new rules were added to the [WAF](https://developers.cloudflare.com/waf/) managed ruleset.

## Why it matters

CVE-2026-42945 is a stale-state bug around `is_args` in nginx's rewrite module. By sending a crafted URI, an attacker can trigger a heap buffer overflow in an nginx worker process. If it works, it can crash the worker for a denial of service, and combined with heap feng shui techniques it could even lead to remote code execution (RCE). Because it lives close to the roots of the web server, it's a genuinely scary one.

## What changes

Two new rules that detect this attack landed in the Cloudflare Managed Ruleset, and both default to Block. So if you rely on the managed ruleset, traffic aimed at this CVE gets blocked ahead of time with no action needed from you. The fact that it shipped immediately as an emergency release is the key point.

## Dive Deep

Here is how the source describes the bug itself.

> A length/copy pass mismatch in `ngx_http_script_copy_capture_code()` causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption.

The length-counting pass and the copy pass disagree, so escaped data gets written into an undersized buffer and the heap gets corrupted.

Here are the two rules that were added. Both live in the Cloudflare Managed Ruleset, the action is Block, and both are brand-new detections.

- Rule `...7e52be73`: nginx - Remote Code Execution - Buffer Overread - CVE-2026-42945
- Rule `...9df0ee6c`: nginx - Remote Code Execution - Heap Spray - CVE-2026-42945

A WAF is a shield at the front door, but plugging the root hole is best. Cloudflare strongly recommends upgrading to nginx 1.30.1 or later. As a temporary stopgap if you can't upgrade right away, avoid following a rewrite directive that contains `?` in the replacement string with a `set` or `if` that references capture groups.

## Wrap-up

- Cloudflare's WAF added two emergency rules for nginx CVE-2026-42945
- Both are new detections in the Cloudflare Managed Ruleset, defaulting to Block
- The core issue is a heap buffer overflow in the rewrite module, with DoS and RCE risk
- The real fix is upgrading to nginx 1.30.1 or later; the WAF is the layer in front of that

This one lands hardest for operators running nginx behind Cloudflare. Go double-check that your managed ruleset is switched on!