Critical NGINX Vulnerability CVE-2026-42533 Allows Remote Code Execution

What Happened

F5 released patches on July 15 for a critical NGINX flaw CVE-2026-42533 that lets an unauthenticated attacker trigger a heap buffer overflow in the worker process. The issue lives in the map directive when a regex‑based map references capture variables before the map output variable, causing a mis‑sized buffer.

Technical Analysis

The vulnerability stems from NGINX’s two‑pass script engine. The first pass measures the required buffer size, the second writes the data. If a map’s regex capture is evaluated between these passes, the capture state is overwritten, leading to an undersized buffer and a heap overflow SOC Prime analysis. Exploitation can cause a denial‑of‑service, and on systems with Address Space Layout Randomization disabled, it may allow remote code execution SecurityWeek.

Impact

All NGINX versions from 0.9.6 through 1.31.2 are vulnerable, affecting internet‑facing servers, Kubernetes ingress controllers, and NGINX‑based appliances. Successful exploitation can crash workers, leading to service disruption, or potentially execute arbitrary code, putting any exposed web service at risk.

How to Protect Yourself

• Upgrade to NGINX 1.30.4 (stable) or 1.31.3 (mainline) and NGINX Plus 37.0.3.1 immediately.
• If you cannot patch, switch regex‑based maps to named captures as a temporary mitigation.
• Audit your NGINX configurations for map directives that use regex captures in string expressions.
• Verify ASLR is enabled on your servers to reduce the chance of code execution.

For detailed remediation steps, see the vendor advisory and the security‑press articles linked above.