CVE-2026-42533

Analyzed Analyzed - Analysis Complete

Heap Buffer Overflow in NGINX Plus and NGINX Open Source

Publication date: 2026-07-15

Last updated on: 2026-08-10

Assigner: F5 Networks

Description

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-23

NVD

CVE-2026-42533

EUVD

EUVD-2026-44683

Affected Vendors & Products

Vendor	Product	Version / Range
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_gateway_fabric	From 1.3.0 (inc) to 1.6.2 (inc)
f5	waf	From 5.2.0 (inc) to 5.8.0 (inc)
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_gateway_fabric	From 2.0.0 (inc) to 2.6.7 (exc)
f5	nginx_plus	From 37.0.0.1 (inc) to 37.0.3.1 (exc)
f5	nginx_plus	From r33 (inc) to r36 (exc)
f5	nginx_plus	r36
f5	waf	From 5.9.0 (inc) to 5.13.4 (exc)
f5	waf	From 4.11.0 (inc) to 4.16.0 (inc)
f5	nginx_ingress_controller	From 3.5.0 (inc) to 3.7.2 (inc)
f5	nginx_ingress_controller	From 5.0.0 (inc) to 5.5.3 (exc)
f5	nginx_ingress_controller	From 2026-lts-r1 (inc) to 2026-lts-r4 (exc)
f5	nginx_ingress_controller	4.0.0
f5	nginx_ingress_controller	4.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, it could occur by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker can exploit this by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart. Code execution is possible if ASLR is disabled or bypassed.

Detection Guidance

Detecting this vulnerability requires checking for specific NGINX configurations and potential crashes. Monitor NGINX worker processes for unexpected restarts or crashes. Inspect logs for heap buffer overflow errors. Use commands like 'nginx -t' to validate configurations and 'ps aux | grep nginx' to check for worker process behavior. No direct detection commands are provided in the context.

Impact Analysis

This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or possibly trigger code execution. It does not affect the control plane, only the data plane, meaning it impacts the processing of HTTP requests.

Compliance Impact

This vulnerability primarily causes denial-of-service or potential code execution on NGINX systems. It does not involve unauthorized data access or exposure, which are key concerns for GDPR and HIPAA compliance. However, service disruption from a DoS could impact availability requirements under these regulations.

Mitigation Strategies

Immediately update NGINX Plus and NGINX Open Source to the latest patched versions. If updating is not possible, disable regex matching in map directives or avoid using non-cacheable variables in string expressions. Restrict access to NGINX instances to trusted networks only. Monitor for unusual activity or crashes.

Hi! I’m here to help you understand CVE-2026-42533. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70