CVE-2026-42533
published 2026-07-15CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture…
PriorityP354high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.89%
59.1th percentile
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | nginx_gateway_fabric | 1.3.0 – 1.6.2 | — |
| f5 | nginx_gateway_fabric | >= 2.0.0 < 2.6.7 | 2.6.7 |
| f5 | nginx_ingress_controller | — | — |
| f5 | nginx_ingress_controller | — | — |
| f5 | nginx_ingress_controller | >= 2026-lts-r1 < 2026-lts-r4 | 2026-lts-r4 |
| f5 | nginx_ingress_controller | 3.5.0 – 3.7.2 | — |
| f5 | nginx_ingress_controller | >= 5.0.0 < 5.5.3 | 5.5.3 |
| f5 | nginx_open_source | >= 0.9.6 < 1.30.4 | 1.30.4 |
| f5 | nginx_open_source | >= 1.31.2 < 1.31.3 | 1.31.3 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= 37.0.0.1 < 37.0.3.1 | 37.0.3.1 |
| f5 | nginx_plus | >= R33 < * | * |
| f5 | nginx_plus | >= R36 < R36 P7 | R36 P7 |
| f5 | nginx_plus | >= r33 < r36 | r36 |
| f5 | waf | 4.11.0 – 4.16.0 | — |
| f5 | waf | 5.2.0 – 5.8.0 | — |
| f5 | waf | >= 5.9.0 < 5.13.4 | 5.13.4 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.1HIGH
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
F5 NGINX Plus/NGINX Open Source Map Directive heap-based overflow (EUVD-2026-44683 / Nessus ID 327771)
vuldb·2026-07-30·CVSS 8.1
CVE-2026-42533 [HIGH] F5 NGINX Plus/NGINX Open Source Map Directive heap-based overflow (EUVD-2026-44683 / Nessus ID 327771)
A vulnerability identified as critical has been detected in F5 NGINX Plus and NGINX Open Source. Affected by this vulnerability is an unknown functionality of the component Map Directive. Performing a manipulation results in heap-based buffer overflow.
This vulnerability is cataloged as CVE-2026-42533. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map outp
ghsa_unreviewed·2026-07-15
CVE-2026-42533 [CRITICAL] CWE-122 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map outp
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (
Red Hat
nginx: NGINX map directive and regex matching vulnerability
vendor_redhat·2026-10-14·CVSS 8.1
CVE-2026-93479 [HIGH] CWE-122 nginx: NGINX map directive and regex matching vulnerability
nginx: NGINX map directive and regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impa
Ubuntu
nginx vulnerability
vendor_ubuntu·2026-09-14·CVSS 8.1
CVE-2026-42533 [HIGH] nginx vulnerability
Title: nginx vulnerability
Summary: USN-8563-1 introduced a regression in nginx
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was
backed out in USN-8563-2 because it could cause a regression. This update
includes a better fix for CVE-2026-42533.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives.
Ubuntu
nginx vulnerability
vendor_ubuntu·2026-08-19·CVSS 8.1
CVE-2026-42533 [HIGH] nginx vulnerability
Title: nginx vulnerability
Summary: A security issue was fixed in nginx.
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was
backed out in USN-8563-2 because it could cause a regression. This update
includes a better fix for CVE-2026-42533.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An atta
Ubuntu
nginx regression
vendor_ubuntu·2026-08-19·CVSS 8.1
CVE-2026-42533 [HIGH] nginx regression
Title: nginx regression
Summary: USN-8563-3 introduced a regression in nginx
USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression
in certain environments. This update reverts the fix for CVE-2026-42533
pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An attacker abl
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 8.1
CVE-2026-56434 [HIGH] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabled directives. An attacker able to
intercept traffic and control responses from an upstream server could
possibly use this issue to cause nginx to crash, resulting in a denial of
service. (CVE-2026-56434)
It was discovered that nginx incorrectly handled certain reque
Ubuntu
nginx regression
vendor_ubuntu·2026-07-20·CVSS 8.1
CVE-2026-42533 [HIGH] nginx regression
Title: nginx regression
Summary: USN-8563-1 introduced a regression in nginx
USN-8563-1 fixed vulnerabilities in nginx. One of the fixes introduced ABI
changes that could cause issues with external modules. This update reverts
the fix for CVE-2026-42533 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could use
this issue to cause nginx to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-42533)
It was discovered that nginx had a use-after-free vulnerability in the
ngx_http_ssi_module module when configured with Server-Side Includes,
proxy_pass, and proxy buffering disabl
F5
CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expr...
vendor_f5·2026-07-15·CVSS 8.1
CVE-2026-42533 [HIGH] CWE-122 CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expr...
CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expr...
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (
Red Hat
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
vendor_redhat·2026-07-15·CVSS 8.1
CVE-2026-42533 [HIGH] CWE-131 nginx: NGINX: Arbitrary code execution via crafted HTTP requests
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulner
No detection rules found.
No public exploits indexed.
Hackernews
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
blogs_hackernews·2026-10-15
CVE-2025-23419 NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.
There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.
A fourth lets an attacker forge a TLS session that could get past client-certificate checks, though F5 calls the forgery non-deterministic and beyond the attacker's control. The fifth lets an HTTP/3 client slip e
Hackernews
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
blogs_hackernews·2026-07-20·CVSS 8.1
CVE-2026-42533 [HIGH] Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
CVE-2026-42533
Triggering it can crash or restart the worker, causing a denial of service; where ASLR is disabled or can be bypassed, F5 says it may also allow remote code execution.
map
Under that pattern the engine's two-pass evaluation comes apart. The first pass measures how many bytes the result needs and allocates a buffer to fit; the second pass writes the bytes in. Both read the same shared capture state, and evaluating the map's regex in between the two passes overwrites it.
$1
This does not hit every nginx server; exposure depend
Hackernews
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
blogs_hackernews·2026-07-20·CVSS 5.9
CVE-2026-63030 [MEDIUM] ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.
The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.
Here is the full recap of what broke, what was exploited, and what needs attention now.
## ⚡ Threat of the Week
New wp2shell WordPress Core Flaw Lets Unauthe
Bugzilla
CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests [fedora-all]
bugzilla·2026-07-16·CVSS 8.1
CVE-2026-42533 [HIGH] CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests [fedora-all]
CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests.
Bugzilla
CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests
bugzilla·2026-07-15·CVSS 8.1
CVE-2026-42533 [HIGH] CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests
CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Imp
2026-07-15
Published