Key Takeaways
- CVE‑2026-42533 is a heap buffer overflow in nginx’s script engine that can be triggered with unauthenticated HTTP requests when a specific regex‑map configuration is present.
- The flaw requires a regex‑based map whose output variable is referenced in a string expression alongside a numbered capture ($1, $2, …) from an earlier regex match.
- Exploitation can crash or restart the worker process (denial‑of‑service) and, if ASLR is disabled or bypassable, may lead to remote code execution.
- Patches are available in nginx 1.30.4 (stable), 1.31.3 (mainline) and NGINX Plus 37.0.3.1; every version from 0.9.6 through 1.31.2 is vulnerable.
- F5 scores the vulnerability CVSS v4 9.2 / CVSS v3.1 8.1, rating attack complexity as high.
- A temporary workaround – switching to named captures – reduces risk but does not fully close the issue; upgrading is the only complete fix.
- The bug is the third heap‑overflow in nginx’s expression‑evaluation code disclosed in roughly two months, sharing a common two‑pass design weakness.
- As of July 20 the flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog and no public exploit code existed, though the discoverer plans to release a proof‑of‑concept after a 21‑day window.
Overview of the Vulnerability
F5 has released patches for a critical nginx flaw tracked as CVE‑2026-42533. The fix appeared on July 15 in nginx 1.30.4 (stable), nginx 1.31.3 (mainline) and NGINX Plus 37.0.3.1. Administrators running any earlier build should upgrade immediately. The vulnerability resides in nginx’s script engine, the component that assembles strings from directives at request time, and can be provoked with a single unauthenticated HTTP request when the server is configured in a particular way.
Configuration Prerequisites
The overflow only manifests under a narrow configuration pattern: a regex‑based map whose output variable is used in a string expression together with a numbered capture ($1, $2, …) from a preceding regex match. For example, a location block that captures $1 via a regex, followed by a map that references $1 in a concatenated string, creates the vulnerable state. Servers lacking this exact arrangement are not affected, regardless of nginx version.
How the Two‑Pass Engine Fails
Nginx’s script engine evaluates expressions in two passes. During the first pass it measures the total bytes needed for the resulting string and allocates a buffer of that size. In the second pass it writes the actual bytes into the buffer. Both passes read the same shared capture state that holds the regex match results. If a map’s regex is evaluated between the two passes, it overwrites the capture state. Consequently, the sizing pass calculates the buffer length based on the original capture (e.g., $1 from the location match), while the writing pass fills the buffer using a different, attacker‑controlled capture that may be longer, causing a heap buffer overflow.
Consequences: DoS and Potential RCE
When the overflow occurs, the worker process can crash or be forced to restart, resulting in a denial‑of‑service condition. F5 notes that, on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the overflow may be leveraged to achieve remote code execution. The attacker controls both the length and the content of the overrun directly from the HTTP request, providing a reliable primitive for memory corruption if mitigations like ASLR are ineffective.
Affected F5 Products and Broader Impact
Beyond the core nginx server, the advisory lists several F5‑maintained products as potentially impacted: NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager. At the time of publication, F5 had not yet released fixed builds for these downstream components, though the core server and NGINX Plus patches address the underlying flaw. Any deployment that uses the vulnerable configuration pattern in these products inherits the same risk.
Severity Scores and Version Range
F5 assigns the vulnerability a CVSS v4 score of 9.2 and a CVSS v3.1 score of 8.1, reflecting a high‑severity issue with elevated attack complexity. The flaw affects every nginx release from 0.9.6 through 1.31.2, a span that reaches back to 2011 when regex support was first added to the map directive. Consequently, a large installed base of legacy systems remains exposed unless upgraded.
Discovery and Researcher Perspectives
CVE‑2026-42533 was reported to F5 independently by more than a dozen researchers, who were thanked for “independently bringing this issue to our attention.” The nginx changelog credits the fix to Mufeed VH of Winfunc Research and to longtime maintainer Maxim Dounin. One of the reporters, Stan Shaw (known online as cyberstan), published a detailed analysis arguing that the flaw can also bypass ASLR, effectively turning a DoS‑only issue into a path to code execution. Shaw claims his technique succeeded in 10 out of 10 tests on a default Ubuntu 24.04 environment, though he has withheld the exploit details and proof‑of‑concept for now.
Mitigation via Named Captures and Its Limits
F5’s interim recommendation is to replace vulnerable regex maps with named captures, a change that Shaw says closes the primary exploitation path for most configurations. However, Shaw warned that a secondary vector remains: a map that defines the same named group as the location regex can still trigger the overflow via an alternate code path, a scenario he confirmed with AddressSanitizer and which F5’s advisory does not mention. According to Shaw, upgrading to nginx 1.30.4 or 1.31.3 (or NGINX Plus 37.0.3.1) is the only complete remedy.
Relation to Earlier Heap Overflows
This bug marks the third heap‑overflow in nginx’s expression‑evaluation code disclosed within roughly two months. Earlier issues include CVE‑2026-42945 (“Rift”) in May and CVE‑2026-9256 (overlapping‑captures in the rewrite module) days later. All three share a common root cause: the two‑pass script engine measures a buffer size in the first pass and writes data in the second, trusting its own measurement. Each vulnerability differs in the precise mechanism that corrupts the measurement—stale flags, overlapping captures, or clobbered capture state—but the underlying design flaw persists.
Current Status and Recommendation
As of July 20, CVE‑2026-42533 had not been added to CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code had appeared. Shaw indicated he will release his own proof‑of‑concept 21 days after the patch, citing the rapid exploitation of the earlier Rift flaw as motivation to encourage prompt patching. F5 has not yet responded to questions about whether the named‑capture mitigation fully addresses the variant Shaw described or when fixed builds for the affected downstream products will ship. Administrators should therefore prioritize upgrading to the patched nginx versions or NGINX Plus release, as this remains the only reliable defense against both denial‑of‑service and potential remote code execution.