depthfirst
depthfirst.com · Company blog · on HN since 2025
depthfirst, a security company, publishes vulnerability research found with AI tools, including NGINX, FFmpeg, and Temporal bugs.
What HN saysHN links its NGINX Rift write-up; commenters discuss the public proof of concept, exploitability under ASLR, and the worker process crash behavior.
16HN people shared it
4linked it in comments
15stories submitted
55story points
5 months agolast shared
2025people per year2026
Most-shared posts
- 1Nginx Rift: Remote Code Execution via an 18-Year-Old Vulnerability6 people · 4 points · first shared 2026 · discussion on HN
- 2Nginx Rift: RCE via heap buffer overflow in rewrite module (CVE-2026-42945)5 people · 8 points · first shared 2026 · 1 comments on HN
- 3Training SOTA vulnerability discovery agents through RL2 people · 3 points · first shared 2026 · discussion on HN
- 4Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)1 people · 11 points · first shared 2025 · 4 comments on HN
- 5Twenty One Zero-Days in FFmpeg1 people · 10 points · first shared 2026 · 3 comments on HN
- 6Supporting critical Open Source with $5M credits for vulnerability detection1 people · 8 points · first shared 2026 · 1 comments on HN
- 7Masked namespace vulnerability in Temporal1 people · 6 points · first shared 2026 · discussion on HN
- 8Esbuild XSS Bug That Survived 5B Downloads and Bypassed HTML Sanitization1 people · 2 points · first shared 2025 · discussion on HN
- 91-Click RCE to steal your Moltbot data and keys1 people · 2 points · first shared 2026 · discussion on HN
- 10LLM security agent finds vulnerability in LLM engineering platform1 people · 1 points · first shared 2025 · discussion on HN
What HN people wrote when they linked it
hetsaraiya · 2026-05-14
Just saw this pop up — full public PoC for CVE-2026-42945 ("NGINX Rift"), a heap buffer overflow in NGINX's ngx_http_rewrite_module that's been there since 0.6.27 (2008).
It triggers on a very common pattern: a `rewrite` directive (with an unnamed capture like $1/$2 and a `?` in the replacement string) followed by `set`, `if`, or another `rewrite`. The root cause is a classic two-pass script engine bug (length calculation vs. actual copy pass with ngx_escape_uri).
The PoC turns it into unauthenticated RCE using cross-request heap feng shui + pool cleanup pointer corruption. Tested with a simple Docker setup.
- Repo + Python exploit: https://github.com/DepthFirstDisclosures/Nginx-Rift
- Full technical write-up: https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-…
- F5 advisory + patches (1.31.0 / 1.30.1 for OSS, plus Plus updates): https://my.f5.com/manage/s/article/K000160932 (or the latest K000161019)
Affects basically any NGINX doing URL rewriting in front of apps/PHP/etc. Workaround mentioned is switching to named captures.
The discovery angle is also interesting — it was found autonomously by depthfirst's security analysis tool after one-click onboarding of the NGINX source.
Anyone running NGINX in production using rewrite rules? How are you checking your configs? Thoughts on the exploit chain or the AI-assisted finding process?
l23k4 · 2026-05-15
I'm deliberately refraining from giving a ready LLM prompt.
History shows that "meh, ASLR mitigates this" is a vastly bolder claim anyway, so I don't feel much need to defend my position here.
Edit: Even the authors of this poc seem to agree with me https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-…
ChrisArchitect · 2026-05-14
linkregister · 2026-05-14
Worker processes are forked from the master, which means they receive the same memory layout. You get unlimited crashes against the worker. There's probably a way to exploit that to get a read oracle. At the very least this is a reliable denial of service.
Depth First's full writeup: https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-…