CVE-2026-42533 – Heap Buffer Overflow leading to DoS / RCE – NGINX Plus and NGINX Open Source

Summary

CVE-2026-42533 is a heap buffer overflow vulnerability (CWE-122) in NGINX Plus and NGINX Open Source, rated High severity with a CVSS v3.1 base score of 8.1. The flaw is triggered by a specific interaction between the map directive and regex capture variables in NGINX configurations, allowing an unauthenticated remote attacker to send crafted HTTP requests that overflow the NGINX worker process heap. The result is a denial-of-service condition (worker restart); on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, full Remote Code Execution (RCE) is possible. The vulnerability was disclosed by F5/NGINX on 2026-07-15.

Technical details

• Root cause: A heap buffer overflow (CWE-122) in NGINX’s map directive processing. The overflow is triggered when a map block uses regex matching and a string expression references the map’s regex capture variables before referencing the map output variable. An equivalent trigger exists when a non-cacheable variable is used in a string expression under certain conditions.
• Trigger conditions: Exploitation requires a specific NGINX configuration pattern using the map directive with regex matching and the described variable reference ordering. Additional conditions beyond the attacker’s direct control must also be met.
• Attack vector: Network — an unauthenticated attacker sends crafted HTTP requests. No local access, credentials, or user interaction is required (PR:N, UI:N).
• Impact: Heap buffer overflow in the NGINX worker process, leading to a worker restart (DoS). Where ASLR is disabled or bypassable, Remote Code Execution is possible. This is a data plane issue only; there is no control plane exposure.

Affected software

NGINX Open Source:

• Versions 0.9.6 through 1.31.2 (mainline branch)
• Versions 0.9.6 through 1.30.3 (stable branch)

NGINX Plus:

• R37 — versions 37.0.0.1 through < 37.0.3.1
• R36 — all versions prior to R36 P7
• R33 and all earlier releases

Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated.

Severity

CVSS v3.1 Base Score: 8.1 (High)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Upgrade NGINX Open Source to version 1.31.3 (mainline) or 1.30.4 (stable) — both released 2026-07-15.
• Upgrade NGINX Plus to version 37.0.3.1 or R36 P7 — both released 2026-07-15.
• If immediate patching is not feasible, audit NGINX configurations for map directives that use regex matching with capture variable references in string expressions, and temporarily restructure or disable affected configuration blocks to reduce exposure surface.
• Verify that ASLR is enabled on all systems running NGINX to limit the potential for RCE in the event of exploitation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-42533 at NIST
• F5/NGINX Security Advisory K000162097
• NGINX Security Advisories