A critical security flaw has been identified in NGINX Plus and NGINX Open Source, posing significant risks by allowing unauthenticated attackers to cause crashes and potentially execute arbitrary code. Known as CVE-2026-42533, this vulnerability is linked to configurations using regex-based map directives or non-cacheable variables in string expressions, particularly when the Stream module’s ssl_preread feature processes crafted TLS traffic.
Understanding CVE-2026-42533
Detailed analysis by Zhenpeng (Leo) Lin highlights that the vulnerability emerges when map directives employ regex matching and string expressions reference regex capture variables before map outputs. This condition also arises with non-cacheable variables in specific setups, potentially causing a heap buffer overflow in NGINX worker processes. On systems with disabled Address Space Layout Randomization (ASLR) or where ASLR can be bypassed, this flaw could escalate to remote code execution.
The root of the issue lies in NGINX’s internal script engine, which evaluates complex values through a two-pass process. The first pass calculates the required buffer size, while the second pass copies data into this buffer. If a regex-based variable is evaluated between these passes, the global capture state may change, leading to a buffer overflow during the second pass.
Impact of the Vulnerability
The Stream module, with its ssl_preread feature, extracts TLS handshake fields like Server Name Indication (SNI) into variables used in complex values, exposing an attack surface to unauthenticated clients. Attackers could exploit this by sending a TLS ClientHello with a crafted SNI to a stream listener configured to evaluate regex captures inside complex values, triggering a heap overflow.
Security experts note that this bug enables both information leakage and out-of-bounds write operations, facilitating ASLR bypass and making exploitation on vulnerable builds more reliable. The vulnerability underscores the importance of maintaining robust security configurations and promptly addressing known vulnerabilities.
Mitigation and Future Outlook
Organizations using NGINX Plus or Open Source with stream blocks, ssl_preread, or regex-based maps should prioritize patching this vulnerability. In the interim, reducing exposure of stream listeners to untrusted networks, avoiding regex capture references in complex values before map outputs, and ensuring ASLR remains enabled can mitigate risks.
Administrators are advised to monitor updates from F5 and NGINX and apply patches promptly to prevent worker process crashes under malformed ClientHello or HTTP traffic. CVE-2026-42533 highlights the dangers posed by subtle script engine bugs in protocol parsing, emphasizing the need for vigilant configuration management and memory protection practices.
