Read-only Bash checker for owned NGINX servers. It helps an operator answer two questions after the CVE-2026-42945 disclosure:
- Is this server still running an exposed NGINX build or risky rewrite configuration?
- Do local logs show crash, long-URI, or encoding signals that need review before the ticket is closed?
| Need | Link |
|---|---|
| Browse the tool page | https://limo57640-crypto.github.io/nginx-rift-detector/ |
| Read the Ping7 self-check guide | https://ping7.cc/guides/nginx-rift-cve-2026-42945-self-check/ |
| Compare with other Ping7 GitHub tools | https://ping7.cc/github-tools/ |
| Send suspicious output for repair | https://ping7.cc/cve-repair/ |
- All GitHub tools: https://ping7.cc/github-tools/
- Full self-check guide: https://ping7.cc/guides/nginx-rift-cve-2026-42945-self-check/
- CVE repair service: https://ping7.cc/cve-repair/
- Sample repair report: https://ping7.cc/cve-repair/sample-report/
- Live CVE alerts: https://t.me/ping7cve
Open a GitHub issue when the detector crashes, flags a false positive, misses a safe defensive signal, or needs documentation cleanup. Keep the example non-sensitive.
Use Ping7 repair when the result is VULNERABLE or SUSPICIOUS, or when the evidence includes live domains, customer traffic, private logs, crash timestamps, or config lines that should not be posted in public.
- Detector output and version.
- NGINX version and package source.
- Relevant rewrite config lines, sanitized if needed.
- First suspicious timestamp from access or error logs.
- Whether logs were rotated, deleted, or stored off-host.
- You operate NGINX directly, through a reverse proxy, or behind a hosting control panel.
- The server uses rewrite-heavy config and the patch window was not clearly documented.
- You need a terminal result that can be pasted into an incident ticket.
- You want a first pass before paying for cleanup or compromise review.
Inspect first:
curl -fsSLO https://raw.githubusercontent.com/limo57640-crypto/nginx-rift-detector/main/detect.sh
less detect.sh
sudo bash detect.shDo not run remote shell content straight into root. Download the script, review it, then run it on the server you are responsible for.
| Area | Signal |
|---|---|
| Version | NGINX version compared with fixed releases |
| Rewrite config | Dangerous rewrite patterns using captures and query strings |
| Access logs | Very long URIs and heavy percent-encoding |
| Error logs | Worker crash loops and memory-corruption symptoms |
| ASLR | Whether Linux ASLR is disabled |
| Worker user | Whether NGINX workers run as root |
Run this on NGINX servers that:
- Use rewrite-heavy configs.
- Were not patched quickly after the CVE disclosure.
- Expose public reverse-proxy, CDN-origin, API, or WordPress traffic.
- Show unexplained worker crashes or unusual long request paths.
The script reports one of:
CLEAN: no obvious exposure or exploitation indicators found.VULNERABLE: version/config signals indicate exposure.SUSPICIOUS: log or runtime indicators need manual review.
NGINX Rift CVE-2026-42945 Detector
Checks:
- NGINX version
- rewrite configuration
- access and error logs
- Linux ASLR
- worker user
Result: SUSPICIOUS (0 critical, 2 warnings)
Next: review rewrite rules and error-log crash entries before closing the ticket.
Guide: https://ping7.cc/guides/nginx-rift-cve-2026-42945-self-check
This release is designed for interactive triage. It prints CLEAN, VULNERABLE,
or SUSPICIOUS in the terminal and normally exits 0 unless the shell runtime
itself fails. If you need CI-style exit codes, wrap the output status in your
own deployment pipeline.
- It cannot prove exploitation did or did not happen.
- It only reviews local files and logs available to the current user.
- Rotated, deleted, or off-host logs may hide the relevant window.
- Vendor backports can make a package version look older than the actual patched build.
- Upgrade NGINX to a fixed build from your vendor.
- Replace unsafe rewrite capture patterns with safer named captures.
- Keep ASLR enabled.
- Review access and error logs from the exposure window.
- Restart NGINX and confirm the detector reports clean.
If the result is VULNERABLE or SUSPICIOUS, keep the output and send:
Domain or server:
NGINX version:
CVE: CVE-2026-42945
Detector result: CLEAN / VULNERABLE / SUSPICIOUS
First suspicious timestamp:
Symptoms: worker crash, long URI logs, redirect, config change, or scanner result
Logs still available: yes / no
Do not send passwords in the first message. Send symptoms, timestamps, screenshots, and sanitized log snippets.
Need hands-on help: https://ping7.cc/cve-repair
Open an issue if you have a new defensive signal, a false positive, or a distro version that is reported incorrectly. Include the NGINX version, OS family, sanitized config line, and the detector result. Do not post live customer logs, secrets, or attack strings.
This project is defensive only. Run it only on systems you own or are authorized to audit.
No payloads. No broad scanning. No exploitation steps.
MIT