Critical nginx Heap Buffer Overflow Flaw Patched in Latest Updates
F5 has released patches for a critical vulnerability (CVE-2026-42533) in nginx that allows remote, unauthenticated attackers to trigger a heap buffer overflow via crafted HTTP requests. The flaw, fixed on July 15, affects nginx versions 0.9.6 through 1.31.2 spanning releases dating back to 2011 and impacts both the open-source server (1.30.4 stable, 1.31.3 mainline) and NGINX Plus (37.0.3.1).
Exploitation can crash or restart worker processes, leading to denial-of-service (DoS) conditions. If ASLR is disabled or bypassed, F5 warns that remote code execution (RCE) may also be possible. The vulnerability resides in nginx’s script engine, specifically when a regex-based map directive references a numbered capture (e.g., $1) in a string expression after an earlier regex match. The two-pass evaluation process where the first pass measures buffer size and the second writes data fails when the shared capture state is overwritten between passes, causing a buffer overflow with attacker-controlled length and content.
Not all nginx deployments are vulnerable; exposure depends on specific configurations. F5’s advisory lists affected products, including NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager, though fixed versions for these were not yet disclosed at publication. The flaw carries a CVSS v4 score of 9.2 (8.1 under v3.1), reflecting high attack complexity.
The vulnerability was reported independently by over a dozen researchers, with credit for the fix going to Mufeed VH of Winfunc Research and nginx maintainer Maxim Dounin. Security researcher Stan Shaw (cyberstan) published a detailed analysis arguing that the flaw inherently bypasses ASLR on default Ubuntu 24.04 systems, enabling RCE via a single unauthenticated GET request. Shaw’s findings contradict F5’s advisory, which frames RCE as conditional on ASLR being disabled. He withheld proof-of-concept details but confirmed a 10/10 severity in testing.
F5’s recommended mitigation switching regex maps to named captures closes the primary attack path but leaves a secondary vector open if the same named group is reused in a location regex. Shaw confirmed this variant via AddressSanitizer, though F5’s advisory does not address it. The only complete fix is upgrading to patched versions.
This marks the third heap overflow in nginx’s expression-evaluation code disclosed in two months, following CVE-2026-42945 (Rift) and CVE-2026-9256 (rewrite module). All stem from a shared design flaw: a two-pass engine that trusts its initial buffer measurement, allowing subsequent writes to exceed allocated space. As of July 20, no public exploits or CISA catalog listings existed, but Shaw plans to release a proof-of-concept 21 days post-patch. F5 had not responded to inquiries about downstream product fixes or the named-capture mitigation’s completeness by publication.
Source: https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html
F5 cybersecurity rating report: https://www.rankiteo.com/company/f5
"id": "F51784499829",
"linkid": "f5",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology/Software',
'name': 'F5',
'type': 'Vendor'},
{'name': 'nginx Open-Source Server', 'type': 'Software'},
{'name': 'NGINX Plus', 'type': 'Software'},
{'name': 'NGINX Ingress Controller', 'type': 'Software'},
{'name': 'NGINX Gateway Fabric', 'type': 'Software'},
{'name': 'NGINX App Protect WAF', 'type': 'Software'},
{'name': 'NGINX Instance Manager', 'type': 'Software'}],
'attack_vector': 'Remote, unauthenticated HTTP requests',
'date_publicly_disclosed': '2024-07-15',
'date_resolved': '2024-07-15',
'description': 'F5 has released patches for a critical vulnerability '
'(CVE-2026-42533) in nginx that allows remote, unauthenticated '
'attackers to trigger a heap buffer overflow via crafted HTTP '
'requests. The flaw affects nginx versions 0.9.6 through '
'1.31.2 and can lead to denial-of-service (DoS) conditions or '
'remote code execution (RCE) if ASLR is disabled or bypassed. '
'The vulnerability resides in nginx’s script engine when a '
'regex-based *map* directive references a numbered capture in '
'a string expression after an earlier regex match.',
'impact': {'downtime': 'Denial-of-service (DoS) conditions',
'operational_impact': 'Crash or restart of worker processes',
'systems_affected': 'nginx worker processes'},
'investigation_status': 'Patched, but secondary attack vector may remain '
'unaddressed',
'lessons_learned': 'The vulnerability stems from a two-pass engine design '
'flaw in nginx’s expression-evaluation code, which trusts '
'its initial buffer measurement, allowing subsequent '
'writes to exceed allocated space. This is the third heap '
'overflow in nginx’s expression-evaluation code disclosed '
'in two months.',
'post_incident_analysis': {'corrective_actions': 'Redesign the two-pass '
'engine to prevent buffer '
'overflows, and ensure all '
'downstream products are '
'patched.',
'root_causes': 'Two-pass evaluation process in '
'nginx’s script engine, where the '
'first pass measures buffer size '
'and the second writes data, fails '
'when the shared capture state is '
'overwritten between passes, '
'causing a buffer overflow with '
'attacker-controlled length and '
'content.'},
'recommendations': ['Upgrade to patched versions (nginx 1.30.4 stable, 1.31.3 '
'mainline, NGINX Plus 37.0.3.1).',
'Switch regex maps to named captures as a mitigation '
'(though a secondary vector may remain).',
'Monitor for proof-of-concept exploits, expected to be '
'released 21 days post-patch.'],
'references': [{'source': 'F5 Advisory'},
{'source': 'Stan Shaw (cyberstan) Analysis'}],
'response': {'containment_measures': 'Upgrade to patched versions (nginx '
'1.30.4 stable, 1.31.3 mainline, NGINX '
'Plus 37.0.3.1)',
'remediation_measures': 'Switch regex maps to named captures '
'(mitigation)'},
'title': 'Critical nginx Heap Buffer Overflow Flaw (CVE-2026-42533)',
'type': 'Heap Buffer Overflow',
'vulnerability_exploited': 'CVE-2026-42533'}