NGINX CVE-2026-42533: Critical Heap Overflow Bug Could Enable RCE

F5 has released patches for a critical vulnerability in the NGINX web server, tracked as CVE-2026-42533, that allows remote unauthenticated attackers to trigger a heap buffer overflow through specially crafted HTTP requests. The flaw affects every NGINX release from version 0.9.6 through 1.31.2 — a stretch covering more than a decade of deployments since the map directive's regex support was introduced in 2011. F5 rates the issue 9.2 on CVSS v4 and 8.1 on CVSS v3.1, with attack complexity noted as high. Patches landed on July 15 in NGINX 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus 37.0.3.1.

The overflow resides in NGINX's script engine — the component that assembles directive strings at request time. It only triggers under a narrow configuration pattern: a regex-based map whose output variable is referenced in a string expression after a capture from an earlier regex match. Under that pattern, the engine's two-pass evaluation falls apart. The first pass measures the result length and allocates a buffer; the second pass writes the bytes in. Both passes read from shared capture state, and evaluating the map's regex between them overwrites that state. The measuring pass sizes the buffer for the original capture — a reference like $1 from a location match — while the writing pass fills it from an attacker-controlled one. The buffer is too small, and the length and payload contents come directly from the request.

Exposure depends on configuration rather than version alone, meaning not every NGINX instance is reachable. F5's advisory lists NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager as affected alongside the core server and NGINX Plus, though fixed builds for those four products had not been published at the time of writing. Organizations running NGINX in production should verify their configuration and audit their public-facing assets, starting with a port scanner to identify which endpoints are reachable and a SSL/TLS checker to confirm TLS termination is correctly configured.

Researchers disagree on the severity ceiling. F5 conditions remote code execution on ASLR being disabled or bypassable, framing practical impact as denial-of-service on most default deployments. Independent reporter Stan Shaw, who publishes as cyberstan, disputes that framing in a detailed technical writeup. He argues the flaw itself supplies the ASLR bypass: when the clobbered capture is smaller than the original, the oversized buffer returns uninitialized heap data, and on a default Ubuntu 24.04 build a single unauthenticated GET recovers the addresses a payload needs. "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw told The Hacker News. The vulnerability was reported by more than a dozen researchers, with NGINX's changelog crediting Mufeed VH of Winfunc Research and maintainer Maxim Dounin for the fix. Operators should also confirm the scope of their exposure with a WHOIS lookup on affected hostnames before applying upgrades.