NGINX漏洞 CVE-2026-42945 防護實戰：由偵測到修復 Step-by-Step

# Check NGINX version
nginx -v

# 或者用 dpkg/rpm
dpkg -l | grep nginx
rpm -qa | grep nginx

# Backup config 先
cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak.$(date +%Y%m%d)

# Edit nginx.conf，comment out HTTP/3 listen directive
# 原本：listen 443 quic reuseport;
# 改為：listen 443 ssl reuseport;
# 刪除或 comment out：quic 相關 directive

nginx -t && nginx -s reload

# 用 ModSecurity + nginx connector
# /etc/nginx/modsec/modsecurity.conf
SecRuleEngine On
SecRule REQUEST_HEADERS:Content-Type "@rx application/x-quic" \
  "id:10001,deny,status:403,msg:'Potential CVE-2026-42945 exploit attempt'"

# Ubuntu/Debian
sudo apt update && sudo apt install --only-upgrade nginx

# RHEL/CentOS/Rocky
sudo dnf update nginx

# 如果用官方 repo
# 先加 official nginx repo
sudo tee /etc/yum.repos.d/nginx.repo << 'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/\$releasever/\$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
EOF

sudo dnf update nginx

sudo systemctl restart nginx
sudo systemctl status nginx

nginx -v
# 應該要見到 1.27.3 或以上

# Check for crash signatures
grep -i "worker process.*exited on signal" /var/log/nginx/error.log | tail -20

# Check for QUIC-related crashes
grep -i "quic" /var/log/nginx/error.log | grep -i "error\|crash\|fatal" | tail -20

# Look for suspicious 444/400 responses
grep " 444 " /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

# /etc/cron.d/nginx-cve-check
0 */6 * * * root /usr/local/bin/nginx_cve_check.sh

#!/bin/bash
# nginx_cve_check.sh - Monitor for CVE-2026-42945 NGINX漏洞 exploitation

CRASH_COUNT=$(grep -c "worker process.*exited on signal" /var/log/nginx/error.log 2>/dev/null)
VERSION=$(nginx -v 2>&1 | grep -oP '\d+\.\d+\.\d+')

if [ "$CRASH_COUNT" -gt 5 ]; then
  echo "[ALERT] NGINX漏洞: $CRASH_COUNT worker crashes detected on $(hostname)" \
    | mail -s "NGINX CVE-2026-42945 Alert" admin@yourdomain.com
fi

if [[ "$VERSION" < "1.27.3" ]]; then
  echo "[WARN] NGINX漏洞: Version $VERSION is vulnerable. Please upgrade!" \
    | mail -s "NGINX Version Alert" admin@yourdomain.com
fi