A critical heap overflow vulnerability, present in NGINX’s rewrite module for approximately 18 years, allows an unauthenticated attacker to execute arbitrary code on affected servers with a single HTTP request. NGINX serves approximately 34% of global web infrastructure, placing critical infrastructure at risk. The flaw affects NGINX Open Source, NGINX Plus, and a broad F5 product ecosystem including WAF, Ingress Controller, and Gateway Fabric components. A public proof-of-concept exploit is already available, meaning exploitation is accessible to low-skilled attackers, and active scanning or attacks should be assumed imminent.