Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

A critical vulnerability (CVE-2026-42533) in NGINX allows unauthenticated remote code execution, potentially due to a heap buffer overflow triggered by a specific configuration involving regex-based maps. The vulnerability affects a wide range of NGINX versions dating back to 2011, and while initial reports focused on denial-of-service, a researcher demonstrated a path to remote code execution, particularly when ASLR is disabled or bypassed. Upgrading to NGINX 1.30.4 or 1.31.3 is the recommended solution, with a temporary mitigation involving named captures.

Triggering the vulnerability requires a specific configuration: a regex-based map whose variable appears in a string expression alongside a numbered capture ($1, $2) from an earlier regex. The vulnerability stems from NGINX's two-pass script engine, where one pass measures a buffer size and the next writes data into it, and each time the write outruns the size it measured.

Researcher Stan Shaw, publishing as cyberstan, highlighted that this vulnerability is not simply a denial-of-service issue, as F5 initially suggested. He demonstrated a path to remote code execution, especially when ASLR is disabled or bypassed. His automated scanner identifies exploitable configurations, but does not exploit them directly.

F5 has released fixes for NGINX 1.30.4 and 1.31.3, and NGINX Plus 37.0.3.1. For users unable to patch immediately, a temporary mitigation involves switching affected regex maps to named captures, although Shaw notes this leaves a narrower path open for exploitation.

This is the third heap overflow in NGINX's expression-evaluation code disclosed in about two months, following CVE-2026-42945 (Rift) in May and an overlapping-captures bug in the rewrite module (CVE-2026-9256) shortly after. All three share a common weakness: a two-pass design that trusts its own measurement. The researcher emphasized that the exploit for CVE-2026-42945 went public within days and drew active exploitation soon after, highlighting the urgency of upgrading before CVE-2026-42533 is exploited.

As of July 20, CVE-2026-42533 was not on CISA's Known Exploited Vulnerabilities catalog and no public exploit code had appeared. F5 had not responded to The Hacker News's request for clarification on whether the named capture mitigation fully closes CVE-2026-42533, or when fixed builds for the affected downstream products will ship.