CVE-2026-42945 Nginx

[Drain Bamaged]

Hi everyone,

I’m looking for some practical advice regarding the recent NGINX Rift vulnerability (CVE-2026-42945) and how it impacts 3CX.

From what I understand, it affects NGINX versions 0.6.27 through 1.30.0, but only if you have a very specific setup involving specific rewrite rules. We are currently running 3CX v20 Update 8 on Windows, and our bundled NGINX version is 1.26.3—which technically puts us in the affected range. Since active exploits are starting to pop up, we want to make sure we're covered.

We already checked our NGINX configuration files (C:\Program Files\3CX Phone System\Bin\nginx\conf) and couldn't find any rewrite rules that would trigger this flaw, as stated in the CVE.

That said, we’d love to get an official, vendor-supported answer on a couple of things:

Is the default 3CX configuration safe from being exploited by this?

What is the official game plan? Should we just wait for the next 3CX update with a patched NGINX version? -or- Are there any temporary workarounds we should apply, just to be safe?

Thanks.

 

[PhonerBY]

If my informations are correct, same issue with the kernel of the Debian-OS. EUVD-2026-24639 / CVE-2026-31431

 

[NikosT_3CX]

@Drain Bamaged we are already aware of this and we checked it when the CVE has been released.
The PBX is not affected by this one.
Since though we always want to be safe and up to date, once a fix is provided from Debian and is tested from our side, the updates will be included in the 3CX reporisotries.


@PhonerBY please check here : https://www.3cx.com/community/threads/copyfail-kernel-vulnerability-cve-2026-31431.137195/

 

[PhonerBY]

@PhonerBY please check here : https://www.3cx.com/community/threads/copyfail-kernel-vulnerability-cve-2026-31431.137195/

Perfect, thank you. Sorry that I've failed to see this thread.

 

[fxbastler]

once a fix is provided from Debian

since 16.05.2026:
https://lists.debian.org/debian-security-announce/2026/msg00189.html

 

[KyriacosS_3CX]

since 16.05.2026:

once a fix is provided from Debian and is tested from our side,

Glad to be of assistance

 

[fxbastler]

Hello @KyriacosS_3CX,

Glad to be of assistance

not really :\

I already read that the first time, so there is no need for me to read it again.
If you read what @NikosT_3CX wrote yesterday, you will notice that his statement can be understood as if 3CX is still waiting for the corresponding update from Debian. That is not the case. That is the only thing I pointed out.

I did not comment on the duration of the hopefully already started 3CX review of this update. We have been waiting since Monday for approval from 3CX, so far without success.

 

[fxbastler]

Thank you for providing the nginx 1.22.1-9+deb12u7 package for the 3CX v20u9 rc. When will the package be released for 3CX v20 Update 8?

 

[Jose Lara]

Debian has already released the updated and patched versions. How long will it take for 3CX to include it in the repository so the update can be applied?

Best regards,