Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
A critical NGINX vulnerability can crash workers and may allow remote code execution. The flaw, CVE-2026-42533, was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
Intelligence analysis by Llama
A critical NGINX vulnerability, CVE-2026-42533, can crash workers and may allow remote code execution. The flaw was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1. The vulnerability is triggered by a specific configuration, where a regex-based map is used in a string expression alongside a numbered capture from an earlier regex.
Imagine you're building a house, and you need to measure how much wood you need for the walls. But, someone else comes along and changes the plan while you're measuring, so you end up with too little wood. That's what's happening in NGINX's script engine. A bad guy can send a special request that makes NGINX measure the wrong amount of wood, and then fill the wall with the wrong amount of wood. This can make NGINX crash or even let the bad guy run their own code on the server.
Analysis
A Critical Vulnerability in NGINX's Script Engine
The vulnerability, CVE-2026-42533, is a heap buffer overflow in NGINX's script engine, which can be triggered by a specific configuration. The flaw is caused by the script engine's two-pass evaluation, where the first pass measures how many bytes the result needs and allocates a buffer to fit, and the second pass writes the bytes in. Both passes read the same shared capture state, and evaluating the map's regex in between the two passes overwrites it. This causes the measuring pass to size the buffer for the original capture, while the writing pass fills it from a different, attacker-sized one. The buffer is too small, and both the length and the content of the overrun come straight from the request.
The vulnerability is not limited to a specific version of NGINX, but rather depends on the configuration. F5's advisory lists the flaw as affecting NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager alongside the core server and NGINX Plus. However, at publication, F5 had not listed fixed builds for those four products.
The Fix and Mitigation
The fix for the vulnerability is to upgrade to nginx 1.30.4 or 1.31.3, or NGINX Plus 37.0.3.1. For anyone who cannot patch right away, F5's temporary mitigation is to switch affected regex maps to named captures. However, this mitigation leaves a narrower path open, as a map that defines the same named group as the location regex can still reach the same overflow through a second code path.
The Third Heap Overflow in NGINX's Expression-Evaluation Code
This is the third heap overflow in NGINX's expression-evaluation code disclosed in about two months, after Rift (CVE-2026-42945) in May and an overlapping-captures bug in the rewrite module (CVE-2026-9256) days later. All three are the same class of flaw: NGINX's two-pass script engine sizes a buffer in one pass and writes into it in the next, and each time the write outruns the size it measured. The trigger differs, a stale flag in Rift, overlapping captures in the rewrite bug, clobbered capture state here. The shared weakness, as the researcher notes, is a two-pass design that trusts its own measurement.
Key points
- A critical NGINX vulnerability, CVE-2026-42533, can crash workers and may allow remote code execution.
- The flaw was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
- The vulnerability is triggered by a specific configuration, where a regex-based map is used in a string expression alongside a numbered capture from an earlier regex.
- F5's temporary mitigation is to switch affected regex maps to named captures.
- However, this mitigation leaves a narrower path open, as a map that defines the same named group as the location regex can still reach the same overflow through a second code path.
If this vulnerability is patched quickly, it's possible that the impact will be limited to a few specific configurations, and that the majority of NGINX users will be able to upgrade to a fixed version without issue. Additionally, the temporary mitigation of switching to named captures may help to reduce the risk of exploitation.
However, the fact that this is the third heap overflow in NGINX's expression-evaluation code in a short period of time suggests that there may be a deeper issue with the design of the script engine. If this is the case, it may be more difficult to patch the vulnerability, and the impact could be more widespread.
