NGINX CVE-2026-42945: Check Point-Managed NGINX Deployments Not Affected

[Vani]

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. 

Check Point Statement Regarding NGINX Vulnerability CVE-2026-42945

Check Point is aware of the recently disclosed NGINX vulnerability CVE-2026-42945 affecting the ngx_http_rewrite_module component in certain NGINX configurations. According to the official F5 advisory, the vulnerability may be triggered under specific conditions involving rewrite directives, unnamed PCRE capture groups, and replacement strings containing a question mark (?).

Following internal assessment and validation, Check Point confirms that Check Point-managed NGINX deployments are not affected by this vulnerability. The impacted ngx_http_rewrite_module functionality and vulnerable rewrite configuration pattern are not utilized within the Check Point WAF architecture or request processing flow.

All Check Point-managed NGINX deployments, including Check Point WAF SaaS, AppSec Gateway, and Unified Container configurations, are not vulnerable to this CVE. Nevertheless, updated images including NGINX version 1.30.1 will be released shortly as part of our ongoing security and software maintenance process.

Customers independently managing external or customer-owned NGINX infrastructure are strongly encouraged to upgrade their NGINX deployments to version 1.30.1 (or later) in accordance with the vendor’s security guidance and best practices.

Check Point continuously monitors emerging vulnerabilities and security advisories as part of its ongoing product security and hardening processes.

For any questions or additional guidance, please contact your Check Point representative. Check Point remains committed to keeping customers secure and staying ahead of emerging vulnerabilities.

[albertlu]

The vulnerability CVE 2026-42533 was released a few days ago. What impact will this have on the WAF nginx? Thanks.

[khatland]

We need an answer to this, we see our current runs on 1.24.0-r16 which is on the affected list. 

[khatland]

We need an answer to this, we are running on an affected version of NGINX

[_Val_]

Please reach out to TAC to receive an official answer. Unofficially, we are not vulnerable

[Vani · Accepted solution]

We would like to reassure our customers that Check Point WAF managed NGINX deployments are not vulnerable to CVE-2026-42533 and not affected as Check Point WAF currently runs NGINX Open Source 1.30.4, which is listed by NGINX as not vulnerable to CVE-2026-42533.

Please find more details here- CVE-2026-42533: Check Point WAF Managed NGINX Depl... - Check Point CheckMates