F5 Networks has released updates to address a serious security flaw in NGINX that could allow an unauthenticated user to cause a heap buffer overflow in the server’s worker process. This vulnerability, identified as CVE-2026-42533, was addressed on July 15 with the release of nginx 1.30.4 (stable) and 1.31.3 (mainline), as well as NGINX Plus 37.0.3.1. Users running earlier versions are advised to upgrade immediately to mitigate risk.
Potential Impact of the Vulnerability
The flaw can lead to worker process crashes or unplanned restarts, resulting in a denial of service. In scenarios where Address Space Layout Randomization (ASLR) is disabled or circumvented, attackers could execute remote code. The issue stems from a vulnerability in NGINX’s script engine, which handles string assembly from directives during request processing. This vulnerability becomes exploitable under specific configurations involving regex-based maps.
The script engine’s two-pass evaluation process is the root of the problem. The first pass calculates the required buffer size, and the second writes data into it. Both passes rely on the same shared capture state, which, when overwritten by the regex evaluation in between, causes the buffer overflow.
Configuration-Specific Exposure
Not all NGINX servers are susceptible to this vulnerability; the risk is dependent on server configuration rather than the version alone. The flaw affects various NGINX products, including the NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager, in addition to the core server and NGINX Plus. However, F5 has yet to announce fixed builds for these products.
The vulnerability was given a CVSS score of 9.2 based on version 4 of the scale and 8.1 on version 3.1, indicating a high attack complexity. The affected versions span from 0.9.6 through 1.31.2, a range dating back to 2011 when regex support was first introduced.
Research and Mitigation
Multiple researchers independently reported CVE-2026-42533, with F5 acknowledging their contributions. NGINX’s changelog credits Mufeed VH of Winfunc Research and Maxim Dounin for resolving the issue. Cybersecurity researcher Stan Shaw, also known as cyberstan, has detailed the vulnerability’s potential beyond what F5’s advisory states, suggesting that the flaw itself could bypass ASLR protections.
F5 recommends upgrading to the latest NGINX versions as a complete fix. For those unable to update immediately, a temporary mitigation involves switching affected regex maps to named captures. However, Shaw points out that this workaround may still leave some configurations vulnerable.
As of July 20, there were no public exploits for CVE-2026-42533 listed in CISA’s Known Exploited Vulnerabilities catalog. Shaw plans to release a proof-of-concept 21 days post-patch. To avoid potential exploitation, users are strongly encouraged to upgrade their systems promptly.
