CVE-2026-42533 is a heap buffer overflow in regular-expression processing by the map directive in NGINX Plus and NGINX Open Source. An unauthenticated attacker can send crafted HTTP requests that restart a worker process and cause denial of service. Code execution is possible only when ASLR is disabled or the attacker can bypass it, so this is not described as unconditional RCE.
Immediate Actions Required
- ✓Update to the fixed version confirmed by official sources
- ✓Apply official workarounds until the update is performed
- ✓Check for signs of compromise
Vulnerability Overview and Scope
This vulnerability (CVE-2026-42533) is a heap buffer overflow present in NGINX's `map` directive and its regular expression matching process. If an attacker sends a specially crafted HTTP request under specific conditions, the NGINX worker process could crash, leading to a Denial of Service (DoS). Furthermore, in environments where ASLR protection is bypassed or disabled, this could escalate to arbitrary code execution.
Affected NGINX Open Source ranges are 0.9.6 before 1.30.4 and 1.31.2 before 1.31.3. Affected NGINX Plus ranges are 37.0.0.1 before 37.0.3.1, R36 before R36 P7, and R33. Releases past End of Technical Support were not evaluated by F5.
Specific Impact and Attack Scenarios
If this vulnerability is exploited, an unauthenticated remote attacker could send a specially crafted HTTP request to crash an NGINX worker process, thereby stopping the web service. Repeated attacks could lead to a persistent Denial of Service (DoS). Furthermore, under conditions where an attacker can disable or bypass ASLR, this heap buffer overflow could be exploited to execute arbitrary code on the target system, potentially leading to full server control. While active exploitation of this vulnerability has not been confirmed, the potential impact is extremely severe.
Remediation Steps and Verification
To address this vulnerability, please update immediately to one of the following fixed versions:
- ✓Update the NGINX Open Source stable branch to 1.30.4 or later
- ✓Update the NGINX Open Source mainline branch to 1.31.3 or later
- ✓Update NGINX Plus to 37.0.3.1, R36 P7, or the fixed build specified through support
- ✓Inventory configurations using regex captures in map and reduce exposure until updating is complete
F5 rates the issue CVSS v4.0 9.2 CRITICAL and CVSS v3.1 8.1 HIGH; both are shown because they use different scoring systems. Installing a fixed release is the durable remediation, and an improvised configuration change is not a substitute for an official workaround.
📦