**F5** has released urgent fixes for a critical **NGINX** vulnerability, **CVE-2026-42533**, which could allow a remote, unauthenticated attacker to trigger a heap buffer overflow. This vulnerability, if exploited, can lead to denial-of-service by crashing or restarting the worker process. More alarmingly, if ASLR is disabled or can be bypassed, it may enable remote code execution. ### The Technical Breakdown of the Flaw The overflow resides within **NGINX**'s script engine, specifically in the code responsible for assembling strings from directives during request processing. The vulnerability manifests only under a precise configuration: when a regex-based `map` directive's output variable is referenced in a string expression *after* a capture from an earlier regex match. This specific pattern disrupts the engine's two-pass evaluation process. The first pass calculates the required buffer size based on the original capture, while the second pass writes the content. An intervening evaluation of the `map`'s regex overwrites the shared capture state, leading to a mismatch. The buffer, sized for the original, smaller capture, becomes too small for the attacker-controlled content, resulting in a heap buffer overflow where both the length and content of the overrun are dictated by the request. ### Widespread Impact and Affected Products While not every **NGINX** server is immediately vulnerable, exposure depends heavily on the configuration, not just the version. **F5**'s advisory lists **NGINX Ingress Controller**, **Gateway Fabric**, **App Protect WAF**, and **Instance Manager** as affected, alongside the core server and **NGINX Plus**. However, **F5** had not yet released fixed builds for these four products at the time of publication. **F5** rates the flaw with a CVSS v4 score of 9.2 and a v3.1 score of 8.1, noting its high attack complexity. The vulnerability affects all **NGINX** versions from 0.9.6 through 1.31.2, a range that extends back to 2011, when `map` gained regex support. ### Independent Research Reveals Greater Risk **CVE-2026-42533** was reported to **F5** by over a dozen researchers. **NGINX**'s changelog credits **Mufeed VH** of **Winfunc Research** and maintainer **Maxim Dounin** for the fix. One of the reporters, **Stan Shaw** (publishing as **cyberstan**), provided a more detailed writeup, suggesting the flaw is more severe than **F5**'s initial assessment. **Shaw** argues that the vulnerability itself can bypass ASLR. He claims that the capture clobbering can also work in reverse, providing uninitialized heap data when the clobbered capture is smaller than the original. On a default Ubuntu 24.04 build, a single unauthenticated GET request could recover the necessary addresses for a payload.  "A reader of the **F5** advisory could reasonably conclude this is DoS-only on default systems. It is not," **Shaw** stated, emphasizing a 10 out of 10 success rate in his testing. He is currently withholding exploitation details and a proof-of-concept (PoC). ### Mitigation and The Only Complete Fix The primary fix is to upgrade to **NGINX** 1.30.4 (stable), 1.31.3 (mainline), or **NGINX Plus** 37.0.3.1. For those unable to patch immediately, **F5** suggests switching affected regex maps to named captures as a temporary mitigation. However, **Shaw** warns that this mitigation leaves a narrower path open: a `map` defining the same named group as the location regex can still lead to the overflow through a secondary code path, a detail not mentioned in **F5**'s advisory. "Upgrading to 1.30.4 / 1.31.3 is the only complete fix," he stressed. Administrators should look for a regex-based `map` whose variable appears in a string expression alongside a numbered capture (e.g., `$1`, `$2`) from an earlier regex, with the capture written before the map variable. **Shaw** has also released a [scanner](https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner) to automate this configuration check across **NGINX** configurations, following includes and flagging only exploitable orderings. This tool does not exploit the vulnerability but helps identify vulnerable instances. ### A Pattern of Vulnerabilities This is the third heap overflow in **NGINX**'s expression-evaluation code disclosed in approximately two months, following **Rift** (**CVE-2026-42945**) in May and an overlapping-captures bug (**CVE-2026-9256**) in the rewrite module shortly after. All three share a common root cause: **NGINX**'s two-pass script engine incorrectly sizes a buffer in one pass, leading to an overrun during the write pass. The specific triggers differ, but the underlying weakness is the engine's flawed trust in its own measurement.  As of July 20, **CVE-2026-42533** was not listed on **CISA**'s **Known Exploited Vulnerabilities catalog**, and no public exploit code had emerged. **Shaw** plans to release his PoC 21 days after the patch. The rapid exploitation of **Rift** serves as a stark reminder of the urgency to upgrade before public exploit code for this new vulnerability becomes available. The Hacker News reached out to **F5** for clarification on the completeness of the named captures mitigation and the release timeline for fixed builds in downstream products but did not receive a response by publication.