thinQtankLABS

Root-Cause & Secure Configuration: CVE-2026-42945

Analyze CVE-2026-42945 at the source: understand the NGINX rewrite-module buffer-size miscalculation (CWE-131/122) and the upstream fix, reject a config change that only relocates the trigger, deploy a named-capture config, upgrade, add a WAF control, and verify with audit and vulnscan.

Expert 20 guided steps 4 tasks About 75 minutes Runs in your browser

Skills you will practice

  • Root-cause analysis
  • Reading upstream patches
  • Secure NGINX configuration
  • Static config review (SAST)
  • Named vs unnamed captures
  • WAF compensating controls
  • Defense in depth

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

ISC2 CSSLP CSSLP Secure configuration and software weaknesses Training at thinQtank Learning CompTIA SecurityX CAS-005 (CASP+) Secure architecture and hardening Training at thinQtank Learning CompTIA Linux+ XK0-005 NGINX configuration and hardening Training at thinQtank Learning
Part of these certification lab packages: SecurityX (CASP+) CAS-005 Linux+ XK0-005 CSSLP

The scenario

Triage patched the proxy; IR handled the crash storm. You are the security engineer who has to explain the bug and harden the configuration against this class. Start with the root cause.

What you will do

  1. Understand the root cause4 steps

    Open the review folder · Read the root-cause note · Read the upstream patch · What is the root cause?

  2. Review the triggering config5 steps

    Read the current config · Audit the config · Review a proposed fix · Audit the proposed fix · …

  3. Apply the fix and controls7 steps

    Read the correct config · Audit the correct config · What makes it safe? · Deploy the config · …

  4. Reason and document4 steps

    Three layers · Verify the config control · Write the hardening note · The principle

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.