Preliminary research

NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability

Zhenpeng (Leo) Lin · depthfirst · 13 May 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from April through September. Unranked, incomplete, not community-vetted, and subject to change.

NGINX rewrite bytecode computes an escaped URI length and later copies it with stale script-engine state, creating a heap overflow when the two passes disagree. Cross-request pool grooming and a cleanup-handler overwrite turn the memory corruption into demonstrated code execution.

Record

Researcher

Zhenpeng (Leo) Lin

Published by

depthfirst

Date

13 May 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• PoC Repository

Tags

• nginx
• memory-corruption
• rce
• cve

This page is the archive's own catalogue record. The research is the work of Zhenpeng (Leo) Lin, first published at the original source. Preserved copies are kept so the citation survives its host.