CVE-2026-42533: NGINX Heap Buffer Overflow DoS Vulnerability

CVE-2026-42533 Overview

CVE-2026-42533 is a heap buffer overflow [CWE-122] affecting NGINX Plus and NGINX Open Source. The vulnerability occurs when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. The same condition can arise when a non-cacheable variable appears in a string expression under specific configurations. An unauthenticated remote attacker can send crafted HTTP requests to corrupt the NGINX worker heap.

Critical Impact
Successful exploitation causes a denial-of-service through worker process restart. On systems where Address Space Layout Randomization (ASLR) is disabled or bypassed, attackers can achieve remote code execution on the NGINX data plane.

Affected Products

NGINX Plus (supported versions per F5 advisory)
NGINX Open Source (supported versions per F5 advisory)
Deployments using map directives with regex capture variables in string expressions

Discovery Timeline

2026-07-15 - CVE-2026-42533 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-42533

Vulnerability Analysis

The flaw resides in how NGINX evaluates variables produced by map directives configured with regex patterns. When a string expression references the map's regex capture variables (for example $1, $2) before referencing the map output variable itself, NGINX mismanages the heap buffer holding the captured values. The worker process writes beyond the allocated buffer, corrupting adjacent heap memory.

A parallel path to the same condition exists when a non-cacheable variable is used in a string expression under specific runtime states. Both paths converge on the same corrupted allocation logic within the request processing pipeline. The vulnerability affects the data plane only; the NGINX control plane is not exposed.

Exploitation requires specific configuration patterns and runtime conditions outside the attacker's direct control, which raises attack complexity. When conditions align, remote unauthenticated requests trigger the overflow without any user interaction.

Root Cause

The root cause is improper bounds handling when NGINX evaluates ordered variable references tied to regex capture groups within map-produced values. Capture variables are populated on demand, and dereferencing them before the parent map output places the internal buffer in an inconsistent size state. Subsequent writes exceed the allocated heap region, satisfying the pattern classified under [CWE-122] Heap-based Buffer Overflow.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to a vulnerable NGINX server running an affected configuration. The request payload interacts with the vulnerable map block, forcing evaluation order that triggers the overflow. The worker process crashes and restarts, degrading service availability. If ASLR is disabled or the attacker can leak address information, the corrupted heap state can be shaped into arbitrary code execution within the worker process context. Refer to the F5 Support Article K000162097 for the authoritative configuration and version details.

Detection Methods for CVE-2026-42533

Indicators of Compromise

Repeated NGINX worker process crashes or SIGSEGV entries in system logs correlated with HTTP request bursts
error.log entries reporting worker process ... exited on signal 11 with no application-level cause
Anomalous spikes in HTTP requests targeting endpoints served by configurations containing map with regex patterns

Detection Strategies

Audit NGINX configurations for map directives that use regex matches and reference capture variables such as $1 in string expressions before the map output variable
Review configurations for non-cacheable variables used inside string expressions in request-processing contexts
Correlate HTTP access logs with worker restart events to identify request patterns preceding crashes

Monitoring Recommendations

Alert on repeated NGINX worker restarts within short time windows using process supervisors or host telemetry
Ingest NGINX error.log and system journal data into a centralized log platform and build detections for signal-based worker termination
Monitor request rate anomalies against endpoints handled by regex-based map directives

How to Mitigate CVE-2026-42533

Immediate Actions Required

Apply the fixed NGINX Plus or NGINX Open Source release identified in the F5 Support Article K000162097
Verify ASLR is enabled on all hosts running NGINX to reduce the likelihood of code execution outcomes
Inventory all NGINX configurations across environments and flag any use of map with regex capture variables

Patch Information

F5 has published fixed versions and remediation guidance in the vendor advisory. Consult the F5 Support Article K000162097 for the current list of fixed NGINX Plus and NGINX Open Source releases. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch before patching.

Workarounds

Refactor affected map directives to reference the map output variable before any regex capture variables in string expressions
Remove non-cacheable variables from string expressions that feed request processing where feasible
Confirm ASLR is enabled at the operating system level as a defense-in-depth control against code execution outcomes

bash

# Verify ASLR is enabled on Linux hosts running NGINX
cat /proc/sys/kernel/randomize_va_space
# Expected output: 2 (full randomization)

# Check installed NGINX version against the F5 advisory
nginx -v

# Search configurations for at-risk map directives
grep -rnE 'map\s+.*\s+\$[a-zA-Z0-9_]+\s*\{' /etc/nginx/