NGINX: 15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution

15-Year-Old NGINX Vulnerability (CVE-2026-42533) Enables Remote Code Execution

A critical vulnerability in NGINX, tracked as CVE-2026-42533, has been disclosed after remaining exploitable since March 2011. The flaw, reported by security researcher Stan Shaw, stems from a missing save/restore mechanism in NGINX’s script engine, specifically affecting the handling of PCRE capture state in regex-based directives.

The vulnerability arises when a map directive with regex patterns executes between references to capture groups (e.g., $1), corrupting a shared mutable array (r->captures). This mismatch between NGINX’s LEN (buffer sizing) and VALUE (data writing) passes creates two attack vectors:

• Heap buffer overflow: If the clobbered capture is larger than the original, the VALUE pass writes beyond the allocated buffer, allowing arbitrary memory corruption.
• Information leak: If the clobbered capture is smaller, the oversized buffer exposes uninitialized heap data, including libc and heap pointers, enabling ASLR bypass in a single unauthenticated request.

When chained, these primitives enable reliable remote code execution (RCE) with high success rates tested at 10/10 reliability on Ubuntu 24.04 with full ASLR enabled. Exploitation requires roughly one leak request, 40 spray connections, and one overflow-triggering request.

Scope and Impact

The flaw affects 13 call sites across 9 source files, impacting both HTTP and stream modules. Any configuration combining regex captures (e.g., location, server_name, rewrite, if blocks) with regex-based map variables evaluated in the same request context is vulnerable. Commonly affected directives include:

• proxy_set_header, proxy_pass, fastcgi_param, uwsgi_param, grpc_set_header
• return, add_header, rewrite, set, root, alias, access_log

A separate, independently exploitable variant exists via named capture groups ((?P<name>...)), which are cached differently and remain unpatched in fixes addressing only numbered captures.

Affected Versions and Fixes

Notably, prior patches for other NGINX vulnerabilities (CVE-2026-42945, CVE-2026-9256, CVE-2026-42055, CVE-2026-48142) do not address this flaw, leaving organizations exposed even after applying those updates.

Historical Context

The issue was first flagged in a 2014 NGINX Trac ticket by developer Maxim Dounin, who acknowledged it as a defect but did not classify it as security-critical at the time. The researcher has released a static config scanner to help defenders identify vulnerable directive orderings without exploitation.

Proof-of-concept details are being withheld for 21 days post-patch to prevent immediate weaponization, following the rapid exploitation observed after the disclosure of CVE-2026-42945 ("NGINX Rift").

Source: https://cybersecuritynews.com/15-year-old-nginx-vulnerability/

NGINX cybersecurity rating report: https://www.rankiteo.com/company/nginx

"id": "NGI1784521421",
"linkid": "nginx",
"type": "Vulnerability",
"date": "3/2011",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/Web Servers',
                        'name': 'NGINX Open Source',
                        'type': 'Software'},
                       {'industry': 'Technology/Web Servers',
                        'name': 'NGINX Plus',
                        'type': 'Software'}],
 'attack_vector': 'Unauthenticated HTTP request',
 'data_breach': {'sensitivity_of_data': 'High (ASLR bypass)',
                 'type_of_data_compromised': 'Heap memory (libc/heap '
                                             'pointers)'},
 'description': 'A critical vulnerability in NGINX, tracked as CVE-2026-42533, '
                'has been disclosed after remaining exploitable since March '
                '2011. The flaw stems from a missing save/restore mechanism in '
                'NGINX’s script engine, affecting the handling of PCRE capture '
                'state in regex-based directives. The vulnerability allows '
                'heap buffer overflow and information leak, enabling reliable '
                'remote code execution (RCE) with high success rates.',
 'impact': {'data_compromised': 'Heap data (libc and heap pointers)',
            'operational_impact': 'Potential remote code execution on '
                                  'vulnerable systems',
            'systems_affected': 'NGINX Open Source (0.9.6 – 1.30.3, 1.31.2), '
                                'NGINX Plus R33–R36, NGINX Plus 37.0.0.1 – '
                                '37.0.2.1'},
 'investigation_status': 'Ongoing (PoC details withheld for 21 days)',
 'lessons_learned': 'Historical vulnerabilities can remain exploitable for '
                    'extended periods; thorough review of legacy code is '
                    'necessary. Prior patches may not address all variants of '
                    'a flaw.',
 'post_incident_analysis': {'corrective_actions': 'Patches released to address '
                                                  'the flaw; static config '
                                                  'scanner provided to detect '
                                                  'vulnerable configurations',
                            'root_causes': 'Missing save/restore mechanism in '
                                           'NGINX’s script engine for PCRE '
                                           'capture state, leading to heap '
                                           'corruption'},
 'recommendations': ['Apply the latest NGINX patches immediately',
                     'Use the static config scanner to identify vulnerable '
                     'directive orderings',
                     'Monitor for exploitation attempts',
                     'Review configurations for use of regex captures with map '
                     'directives'],
 'references': [{'source': 'Security Researcher Stan Shaw'},
                {'source': 'NGINX Trac Ticket (2014)'}],
 'response': {'communication_strategy': 'Proof-of-concept details withheld for '
                                        '21 days post-patch',
              'containment_measures': 'Patches released (NGINX Open Source '
                                      '1.30.4, 1.31.3; NGINX Plus R36 P7, '
                                      '37.0.3.1)',
              'remediation_measures': 'Apply fixed versions, scan '
                                      'configurations for vulnerable directive '
                                      'orderings'},
 'title': '15-Year-Old NGINX Vulnerability (CVE-2026-42533) Enables Remote '
          'Code Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-42533 (Missing save/restore mechanism in '
                            'NGINX’s script engine for PCRE capture state)'}