Heap Buffer Overflow in NGINX Plus and Open Source during Regex Mapping
CVE-2026-42533

9.2CRITICAL

Key Information:

Vendor

F5
Status
Nginx Plus
Nginx Open Source
Vendor
CVE Published:
15 July 2026

Badges

📈 Trended📈 Score: 23,500👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-42533?

CVE-2026-42533 is a significant vulnerability identified in NGINX Plus and NGINX Open Source, versions which are widely used for web serving and reverse proxy purposes. This flaw is rooted in the handling of regex mapping within the configuration. Specifically, it arises when a directive uses regex to map variables and where the expression refers to the regex capture variables before the map output variable. An unauthorized attacker could exploit this vulnerability by crafting carefully designed HTTP requests, potentially leading to heap buffer overflow in the NGINX worker process. This vulnerability raises concerns because it could cause service disruptions due to application restarts or even allow code execution, particularly on systems where Address Space Layout Randomization (ASLR) features are disabled or bypassed.

Potential impact of CVE-2026-42533

  1. Denial-of-Service (DoS) Attacks: The vulnerability can lead to a local or remote denial-of-service, interrupting services and affecting users’ ability to access web resources served by NGINX.

  2. Remote Code Execution: Under specific conditions where ASLR protections are circumvented, this flaw may allow an attacker to execute arbitrary code on the affected server, leading to potential system compromise.

  3. Service Disruption: Exploitation may cause frequent restarts of the NGINX worker process, leading to service instability and unreliable performance, which can severely impact business operations relying on these web servers.

Affected Version(s)

NGINX Open Source 1.31.2 < 1.31.3

NGINX Open Source 0.9.6 < 1.30.4

NGINX Plus 37.0.0.1 < 37.0.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

ghostlock-vagrant-box
Created by Daniyal48

CVE-2026-42533
Created by imbas007

CVE-2026-42533-nginx
Created by gagaltotal

News Articles

favicon imageCybersecuritynews

Nginx Buffer Overflow Vulnerability Allows Attackers to Execute Arbitrary Code - PoC Released

A high-severity heap buffer overflow in NGINX Plus and NGINX Open Source can let unauthenticated attackers crash worker processes and, under certain conditions, run arbitrary code.

1 week ago

favicon imageTechtimes

NGINX Map Regex RCE Gets Public Scanner: Patch Now, Full Exploit Due August

CVE-2026-42533 NGINX vulnerability now has a public config scanner as researcher Stan Shaw warns the critical heap buffer overflow — present in all NGINX versions since 2011 — defeats ASLR on its own

2 weeks ago

favicon imageIt Security News

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution - IT Security News

A newly disclosed flaw tracked as CVE-2026-42533 affects nginx’s script engine and has been silently exploitable since March 2011, when the map directive gained regex support. Security researcher Stan Shaw reported the bug to F5 SIRT, which coordinated a fix…Read more →

2 weeks ago

References

https://my.f5.com/manage/s/article/K000162097
vendor-advisorypatch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Security Researchers Ming Xuan of AntAISecurityLab, DKD(@pidifn) of AntAISecurityLab, Rafael Gacek, Ji'an Zhou (AntAISecurityLab), Zhen Yan (AntAISecurityLab), Sergii Negodiuk of EVO.company, Lam Jun Rong of Calif.io, Mufeed VH of Winfunc Research (winfunc.com), Vexera AI (https://vexera.ai), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), "Zhenpeng (Leo) Lin" from "depthfirst", Lukas Johannes Moeller, and Milan Jovic (Kljunowsky) for independently bringing this issue to our attention and following the highest standards of coordinated disclosure.
.