CVE-2026-42533: 
NGINX vulnerability analysis and mitigation

CVE-2026-42533 is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source triggered when a map directive uses regex matching and a string expression references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. Disclosed on July 15, 2026, it affects NGINX Open Source versions 0.9.6 through 1.30.3 (fixed in 1.30.4) and 1.31.2 (fixed in 1.31.3), and NGINX Plus R33 through R36 (fixed in R36 P7) and 37.0.0.1 through 37.0.3.0 (fixed in 37.0.3.1). It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, F5 Advisory).

The root cause is an incorrect calculation of buffer size (CWE-131) leading to a heap-based buffer overflow (CWE-122) in the NGINX worker process. The flaw arises from a "complex_value two-pass capture-clobbering" bug: when NGINX evaluates a string expression that references regex capture variables (e.g., $1, $2) from a map directive before the map's output variable is resolved, the internal buffer size calculation is incorrect, resulting in a heap overflow during the second evaluation pass. The same condition can be triggered using non-cacheable variables in string expressions. An unauthenticated remote attacker can trigger this by sending crafted HTTP requests to a vulnerable NGINX instance configured with the affected map pattern; no authentication or user interaction is required, though exploitation conditions partially depend on server-side configuration factors beyond the attacker's direct control (GitHub Advisory, Red Hat Bugzilla, F5 Advisory).

Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a worker crash and restart — resulting in a denial-of-service condition for active connections. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, an attacker may achieve remote code execution (RCE) as the NGINX worker process user, potentially enabling full compromise of the affected server, data exfiltration, and lateral movement within the network. The vulnerability is a data plane issue only; there is no control plane exposure (GitHub Advisory, F5 Advisory).

A public PoC exploit was released on July 27, 2026 (earlier than the originally announced August 5 date), demonstrating an unauthenticated NGINX worker crash and claiming a working pre-auth RCE chain on Ubuntu 24.04 (Red Hat Bugzilla). A second exploit implementation by DepthFirst Disclosures was published on July 29, 2026, using the stream ssl_preread script-engine path and demonstrating command execution and a reverse shell in a Docker environment, though offsets are calibrated for a specific image and not universally reliable. A static configuration scanner (non-exploiting) was also released on July 15, 2026 to identify vulnerable NGINX configurations (GitHub Scanner). The EPSS score is approximately 0.83–3.6% (varying by source), exploitation is rated as "poc" by NVD SSVC, and the vulnerability is not yet listed in the CISA KEV catalog as of the time of this report. No confirmed in-the-wild exploitation or threat actor attribution has been reported (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing NGINX Plus or NGINX Open Source instances running vulnerable versions (Open Source < 1.30.4 or 1.31.3; Plus < R36 P7 or 37.0.3.1) using tools like Shodan, Censys, or FOFA. Use the public static scanner (nginx_capture_clobber_scan.py) to audit NGINX configuration files for vulnerable map directive patterns.
2. Identify vulnerable configuration: Confirm the target NGINX instance uses a map directive with regex matching where a downstream string expression references the map's regex capture variables (e.g., $1, $2) before the map output variable — the "capture-clobber" pattern.
3. Craft malicious HTTP request: Construct an HTTP request that triggers evaluation of the vulnerable map directive and its associated string expression. The request must cause NGINX to enter the two-pass evaluation path where the buffer size is miscalculated.
4. Trigger heap buffer overflow: Send the crafted request to the target NGINX worker. The incorrect buffer size calculation causes a heap overflow in the worker process, resulting in a worker crash (DoS) and restart.
5. Achieve RCE (ASLR-disabled targets): On systems with ASLR disabled or where ASLR can be bypassed (e.g., via information leak), use calibrated heap exploitation techniques to redirect execution flow. Public PoCs (e.g., imbas007/CVE-2026-42533, DepthFirstDisclosures/Nginx-Rift) demonstrate reverse shell establishment on Ubuntu 24.04 Docker environments with specific heap offsets (Red Hat Bugzilla, GitHub Advisory).

• Network: Unusual or repeated HTTP requests targeting NGINX endpoints that trigger map directive evaluation with regex capture variables; unexpected outbound connections from the NGINX server process to unknown external IPs (potential reverse shell).
• Logs: NGINX error logs (/var/log/nginx/error.log) showing repeated worker process crashes or restarts (e.g., worker process XXXX exited on signal 11); access logs with anomalous request patterns targeting specific URI paths or headers that invoke vulnerable map configurations.
• Process: Unexpected child processes spawned by the NGINX worker (e.g., /bin/bash, sh, curl, wget, python) visible via ps or process monitoring tools; NGINX worker PID cycling rapidly due to repeated crashes.
• File System: Unexpected files written to NGINX working directories or /tmp; new cron jobs, SSH authorized keys, or scripts created by the www-data or nginx service account.
• System: Core dump files generated by NGINX worker crashes in configured core dump directories; ASLR status (/proc/sys/kernel/randomize_va_space = 0) indicating increased RCE risk (Red Hat Bugzilla, F5 Advisory).

Apply the vendor-released patches immediately: NGINX Open Source 1.30.4 or 1.31.3; NGINX Plus R36 P7 or 37.0.3.1 (F5 Advisory, NGINX Release 1.31.3). If immediate patching is not possible, audit all NGINX configuration files for map directives using regex matching where downstream string expressions reference capture variables before the map output variable, and reconfigure or disable such patterns. Ensure ASLR is enabled on all systems running NGINX (echo 2 > /proc/sys/kernel/randomize_va_space) to significantly reduce the risk of successful RCE exploitation. Implement network-level controls to restrict access to NGINX services where feasible, and monitor for worker process crashes as an early indicator of exploitation attempts. Distributions including Ubuntu, Fedora, openSUSE, Debian, Alpine, and Mageia have released updated packages (GitHub Advisory).

F5 published an official advisory (K000162097) on July 15, 2026, and the vulnerability received broad coverage from major security outlets including The Hacker News, SecurityWeek, Security Affairs, GBHackers, and Cyber Security News, with many describing it as a "15-year-old" flaw given the affected version range dating back to NGINX 0.9.6 (The Hacker News, SecurityWeek). The cybersecurity community on Reddit (r/nginx, r/security, r/SecOpsDaily) and Mastodon actively discussed the vulnerability's exploitation conditions and configuration-dependent nature. WinFunc Research was credited with contributing to the vulnerability fix, and published a detailed technical write-up (WinFunc Research). Government CERTs including Hong Kong GovCERT, Thai CERT, NHS Digital, and CISA (via their weekly bulletin) issued alerts urging immediate patching (CISA Bulletin). TechTimes noted that a full exploit was anticipated by August 2026, which was confirmed when a public PoC appeared on July 27, 2026 — ahead of schedule.