nginx is not the bug. Two lines of your config are. CVE-2026-42945 on a live stand

A 9.2 CVSS heap overflow in nginx that sat for eighteen years. Reproduced on a live stand, and two of the rules everyone repeats about it turn out to be wrong.