A recently uncovered security flaw in NGINX, identified as CVE-2026-42533, has been found to enable remote code execution, impacting systems since March 2011. This vulnerability, stemming from the introduction of regex support in map directives, was reported by security researcher Stan Shaw to F5 SIRT. Prompt fixes have been applied in versions nginx 1.30.4 (stable) and 1.31.3 (mainline), with patches also available for NGINX Plus R33–R36 and newer versions.
Understanding the Vulnerability
This pre-authentication flaw arises from improper management of PCRE capture state within NGINX’s script engine, which evaluates expressions in two distinct phases: a LEN pass to determine buffer sizes and a VALUE pass to input data. These phases depend on a shared array called r->captures. When a regex pattern is executed between capture references, it can overwrite shared data, leading to discrepancies between the LEN and VALUE phases.
Such inconsistencies create two attack mechanisms: a heap buffer overflow and an information leak. The former occurs when the capture size exceeds the buffer, allowing excess data to corrupt memory. The latter happens when the buffer is too large, causing uninitialized data exposure, including crucial memory pointers. These vulnerabilities can be exploited to achieve reliable remote code execution, as tested on Ubuntu 24.04 with full ASLR enabled.
Wide-Ranging Impact and Affected Versions
The Cyberstan report highlights that this issue is not limited to a single directive, but rather affects multiple call sites across various source files, influencing both HTTP and stream modules. Configurations using regex capture sources in conjunction with regex-based map variables are at risk, even if they appear in separate directives within the same location block.
Common directives impacted include proxy_set_header, proxy_pass, and others. Additionally, a variant involving named capture groups poses independent risks. Affected versions span from NGINX Open Source 0.9.6 through 1.31.2, with fixes provided in subsequent releases.
Recommendations for Mitigation
Organizations are urged to upgrade to the latest patched versions of NGINX and use the static config scanner available on GitHub to identify vulnerable configurations. Security teams should audit and adjust any location blocks that combine regex captures with map variables to prevent exposure. Immediate action is advised, regardless of recent patch applications for other vulnerabilities like CVE-2026-42945.
In conclusion, this long-standing NGINX vulnerability underscores the importance of continuous security monitoring and prompt patching. By staying informed and taking proactive measures, organizations can defend against potential exploitation and safeguard their systems.
