An AI-powered security platform has uncovered a critical vulnerability in Nginx, a web server used by nearly one-third of all websites on the internet. The flaw, tracked as CVE-2026-42945, is a heap buffer overflow in the URL rewrite module that has existed undetected for 18 years. It allows for potential remote code execution under specific configurations and has been patched in Nginx versions 1.31.0 and 1.30.1.

The discovery was made by DepthFirst AI using an LLM-powered system that identified four security bugs in total. The vulnerability affects both open-source Nginx and commercial products like Nginx Plus, with F5 issuing patches for several impacted products. Exploitation could lead to denial of service or, on systems without ASLR enabled, arbitrary code execution.

Researchers note that the multi-process architecture of Nginx makes exploitation more feasible, as worker processes inherit identical memory layouts, allowing repeated attempts without crashing the entire server. The configuration patterns required to trigger the flaw are common in API gateway setups, raising concerns about widespread exposure. Security teams are urged to update immediately, especially given the public release of proof-of-concept code.