Artificial intelligence has made a milestone breakthrough in the field of cybersecurity. The AI security analysis system developed by startup company depthfirst independently discovered a critical NGINX vulnerability that had been hidden for 18 yearsCVE-2026-42945. The vulnerability was rated as severe (CVSS 9.2), affecting nearly one-third of websites worldwide, allowing attackers to achieve remote code execution (RCE).

image.png

Core Information about the Vulnerability

  • Duration of Exposure: It remained undetected since its introduction in 2008, spanning 18 years.

  • Affected Versions: NGINX versions from 0.6.27 to 1.30.0.

  • Vulnerability Principle: It exists in the rewrite module, caused by a defect in the two-phase processing mechanism of the script engine, leading to a heap buffer overflow.

  • Patched Version: The official has released a patch. It is recommended to upgrade to the open-source version 1.31.0 or 1.30.1, as well as the corresponding commercial version NGINX Plus.

The "Downward Strike" of AI Security Analysis

This vulnerability was discovered by the San Francisco AI laboratory depthfirst. The performance of this system has attracted great attention in the industry:

  • High Efficiency: In just 6 hours of autonomous scanning, the system identified five security issues, including CVE-2026-42945 (four of which have been confirmed by the official as remote memory corruption vulnerabilities).

  • Deep Understanding: Unlike traditional tools, this AI can understand complex business logic and cross-module interactions, discovering vulnerabilities that even top AI security tools had missed.

Data shows that approximately 19 million exposed NGINX instances are affected by this vulnerability. Among them, the United States (about 53.4 million affected instances, including historical cumulative data) and China (about 25.4 million) are the countries with the highest exposure levels. Since the proof-of-concept (PoC) code for this vulnerability has been publicly released, the security risk is extremely high. All enterprises and developers using NGINX are advised to immediately check their configuration files (especially scenarios where both rewrite and set directives are used) and complete the version update as soon as possible.