www.it-connect.fr
NGINX CVE-2026-42533: Critical Flaw Can Crash Your Web Server
On July 15, 2026, F5 patched a critical security flaw in NGINX: CVE-2026-42533, a buffer overflow. This vulnerability has existed in NGINX since 2011 and allows an unauthenticated remote attacker to crash the web server's worker processes with simple HTTP requests. In the worst case, remote code execution is also possible. Here's what we know.
Table of Contents
CVE-2026-42533: a critical flaw in NGINX
This new security flaw, tracked as CVE-2026-42533 and rated CVSS v4.0 9.2 out of 10 (a critical vulnerability), can be exploited by an unauthenticated remote attacker using specially crafted HTTP requests. The flaw lies in NGINX's script engine, the part of the code that assembles strings from directives while processing a request.
CVE-2026-42533 is directly tied to the map directive, as F5 explains in its security bulletin: "A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regular expression matching and a string expression references the regular expression capture variables from the map directive before referencing its output variable." - This means not all NGINX servers are vulnerable: it depends on the installed version, but also on the configuration (more specifically, the use of map with regex).
Let's try to understand exactly what the problem is with this security flaw.
To build a string, NGINX works in two steps. It first calculates how much space is needed, then allocates a buffer (a memory area) of exactly that size. Only then does it copy the data into it. Imagine a box sized for one object, into which you then try to place a second, larger one: the contents overflow. That is what happens here. Between the calculation step and the data copy, the evaluation of the map regular expression modifies the capture used as a reference (for example $1). The buffer is therefore sized for the original capture, but filled from another one whose size and content are dictated by the attacker's request. The container is too small, and the resulting overflow causes arbitrary data to be written into the process memory.
DoS confirmed, code execution: how far does the threat really go?
In its security bulletin, F5 associates this vulnerability with a denial of service: the overflow causes the worker to crash or restart, which disrupts the availability of the web service. F5 also mentions the possibility of remote code execution on a vulnerable server through this flaw, but with one condition: ASLR protection must be disabled or bypassable.
However, one of the researchers who reported the flaw, Stan Shaw, goes further. He has published a report and states clearly that this flaw itself would allow ASLR bypass. This would therefore make remote code execution possible on a vulnerable server.
"The lack of save/restore of the PCRE capture state in Nginx's script engine allows an unauthenticated remote attacker to trigger a heap buffer overflow whose content and length are fully controlled, as well as an information leak of heap pointers sufficient to bypass ASLR. These two vulnerabilities chain together to allow reliable unauthenticated remote code execution.", can be read on his website.
The reason: the overwrite would also work in the other direction. When the overwritten capture is smaller than the original one, the oversized buffer would return uninitialized data from the heap. "This bug does not require ASLR to be disabled. The information leak technique bypasses it in a single GET request.", his report specifies. He also says he did not publish the PoC exploit to give users time to protect themselves.
How can you protect yourself?
According to the security bulletin published by NGINX, all versions from 0.9.6 to 1.31.2 are vulnerable to this security flaw. That covers a lot of versions, since these include current releases and those dating back to 2011, when the map directive first began supporting regular expressions.
The security fixes have been included in the new releases, namely:
- NGINX
1.30.4(stable branch), - NGINX
1.31.3(mainline branch), - NGINX Plus
37.0.3.1.
According to F5, the flaw also affects NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager, with patches rolled out progressively. By contrast, BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS and F5 AI Gateway are not believed to be affected.
Installing the security patch is recommended to stay protected. As a complement, note that researcher Stan Shaw has released a scanner that analyzes your NGINX configuration files to determine whether your server is vulnerable. The idea is to check how your map rules are written.
This new critical flaw in NGINX follows the NGINX Rift (CVE-2026-42945) vulnerability discovered in May. A web server remains a prime target: in recent weeks, NGINX was also targeted by the HTTP/2 Bomb attack, which can exhaust the target machine's memory (although it is not limited to NGINX).
