A Critical NGINX Vulnerability Could Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx bug that allows a remote, unauthorized attacker to initiate a buffer overflow in a worker process via crafted HTTP requests. CVE-2026-42533 patched on July 15 for nginx 1.30.4 (stable) and 1.31.3 (mainline), and for NGINX Plus 37.0.3.1; anyone in the previous building should upgrade.

Enabling it can crash or restart the worker, causing a denial of service; when ASLR is disabled or bypassed, F5 says it can also allow remote decoding.

The overflow resides in the nginx script engine, code that compiles strings from directives at invocation time. It only appears under a certain configuration: regex-based map output variable specified in the string expression after the capture from the previous regex match.

Under that pattern the two engine pass tests are separated. The first pass measures how many bytes the result needs and allocates the buffer to fit; the second pass writes the bytes in between. Both read the same shared capture state, and checking the map regex between the two passes removes it.

So a pass to measure the size of the actual capture buffer, a reference like $1 from the local game, while the writing pass fills from the different, the size of the attacker. The buffer is very small, and both the length and content of the transition come directly from the request.

This does not hit every nginx server; exposure depends on the configuration, not just the version. F5’s advisory lists the bug as affecting NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager alongside the main server and NGINX Plus, although at publication F5 did not list the planned architectures of those four products.

The F5 scores 9.2 on CVSS v4 and 8.1 on the old v3.1 scale, and the attack levels are very high. All nginx versions from 0.9.6 to 1.31.2 are vulnerable, spanning back to 2011, when map got regex support.

CVE-2026-42533 was reported to F5 independently by more than a dozen researchers; The seller thanked them for “representing this issue to us.” nginx’s changelog recommends a fix to Mufeed VH by Winfunc Research and maintainer Maxim Dounin.

One of the reporters, Stan Shawwho publishes as cyberstanwrite detailed information that goes beyond advice. The F5 condition coding in ASLR is disabled or not passed, and Shaw’s argument is that the error provides a bypass in itself. He told Hacker News that the capture is regressive: when the combined capture is less than the first, the main cache returns the unused batch data, and by default Ubuntu 24.04 creates one unauthorized GET to find the addresses that need to be loaded.

“A reader of F5’s advice would reasonably conclude that this is only DoS on automated systems. It’s not,” Shaw said. It’s a stronger claim than F5 makes, which it claims scored 10 out of 10 in its testing, and is withholding exploit details and proof-of-concept for now, so no one can independently test it yet.

The fix is ​​to upgrade to nginx 1.30.4 or 1.31.3, or NGINX Plus 37.0.3.1. For anyone who can’t debug on the fly, a workaround for F5 is to change the affected regex mappings to a dummy capture, which Shaw says covers the main path and covers most of the configuration.

But he told The Hacker News that the cuts leave a narrow path open: a map defining the same named group as a local regex achieves the same overflow with the second code path, which it validates with AddressSanitizer and the F5 hint is meaningless. “Upgrading to 1.30.4 / 1.31.3 is the only complete fix,” he said.

The exposure to grep for is minimal: it is regex-based map variables from string expressions alongside numeric captures ($1, $2) from the previous regex, and capture the written before map variable.

Shaw’s automated scanner checks all activations, the following includes, and flags only usable orders; it does not exploit anything, but as a journalist’s tool it is not a salesman’s product.

This is the third batch of overflows in nginx test code that has been exposed in almost two months, after Rift (CVE-2026-42945) in May and overlap-catch the error in the rewrite module (CVE-2026-9256) after days.

All three are the same category of error: nginx’s two-pass script engine buffers in one pass and writes to it in the next, and each time the script exceeds the measured size. Trigger is different, old flag on Rift, overlapping capture on rewrite bug, merged capture state here. A shared weakness, as the researcher notes, is the two-pass design that relies on its measurement.

As of July 20, CVE-2026-42533 was not in CISA’s catalog of Known Vulnerabilities and no public exploit code has surfaced. Shaw says he will publish his own opinion of the evidence 21 days after the episode, and the Rift is a cautionary tale: its exploitation became public within days and led to active exploitation afterwards. This is a reason to upgrade before this one arrives.

Hacker News asked F5 if the switch to a custom capture fully fixes CVE-2026-42533, given Shaw’s separate documentation, and if a fixed build for downstream products will be shipped. F5 did not respond for publication.