CVE-2026-42533 NGINX Buffer Overflow: Exposure and Patch Guide
CVE-2026-42533 can overflow an NGINX worker process under specific map and regex conditions. This guide separates the score from the real exposure and gives teams a practical patch plan.
CVE-2026-42533 is a heap buffer overflow in NGINX Open Source and NGINX Plus. An unauthenticated attacker can send crafted HTTP requests that may restart an affected worker process, but exposure depends on how the map directive, regex captures, and string expressions interact in the active configuration. NGINX Open Source users should upgrade to 1.30.4 stable or 1.31.3 mainline.
The issue has attracted critical-severity headlines because F5 assigned it a CVSS 4.0 score of 9.2 Critical. The same CVE record gives it a CVSS 3.1 score of 8.1 High, while the NGINX security advisory index uses the vendor category major.
F5 published the CVE on July 15, 2026. The same NGINX release also fixed CVE-2026-60005 in the slice module and CVE-2026-56434 in the SSI module, so teams should treat 1.30.4 and 1.31.3 as a security update rather than patching one code path in isolation.
Key Takeaways
- CVE-2026-42533 requires a vulnerable NGINX version and a specific interaction between
map, regex captures, and string expression evaluation. - NGINX rates the issue
major; F5 scores it 9.2 Critical under CVSS 4.0 and 8.1 High under CVSS 3.1. - NGINX Open Source 1.30.4 stable and 1.31.3 mainline contain the fix, while NGINX Plus has separate fixed releases.
- Upgrade first, then confirm the running binary, complete configuration, worker replacement, and container or package provenance.
How CVE-2026-42533 Causes an NGINX Buffer Overflow
The F5-authored CVE record classifies CVE-2026-42533 as CWE-122, a heap-based buffer overflow. The vulnerable path occurs while NGINX evaluates a complex string whose expected length no longer matches what a later copy operation writes.
NGINX uses the map directive to create a variable from one or more source variables. According to the official map module documentation, a map entry may use a regular expression with named or positional captures, and those captures can be referenced by other directives. A map can also use the volatile parameter, which makes its result non-cacheable.
The vulnerable sequence is narrower than simply having a map block. F5 describes one condition in which a string expression references regex capture variables before it references the output variable from the map. F5 also identifies a second path involving a non-cacheable variable under certain conditions.
The official NGINX fix adds buffer overrun checks to script copy operations. The change introduces an expected buffer-end pointer and checks copy operations against it during complex value evaluation. It applies related protection to both the HTTP and stream implementations.
Why the length calculation can become unsafe
NGINX complex values are compiled into operations that first calculate a result length and then copy variable data into an allocated buffer. Regex capture state or a non-cacheable variable can change between those operations in the affected pattern. If the copy stage writes more bytes than the earlier calculation allowed, it can pass the allocated boundary.
The patch addresses that unsafe assumption at the copy boundary instead of identifying one dangerous configuration string. A configuration-only workaround could miss another affected evaluation path.
What an attacker may achieve
F5 states that a remote, unauthenticated attacker can send crafted HTTP requests that may trigger the overflow when the required configuration is present. The expected operational result is a worker process restart, which can produce a denial of service if requests repeatedly reach the affected path. NGINX uses worker processes to handle requests, so a worker crash is different from direct compromise of the master process or control plane.
F5 also says code execution may be possible when Address Space Layout Randomization is disabled or the attacker can bypass it. That is a conditional impact statement, not evidence that public code execution has occurred. The CVE record’s CISA enrichment marked exploitation as none on July 15, and the CVE was not present in CISA’s Known Exploited Vulnerabilities catalog when this article was checked on July 21.
CVE-2026-42533 Severity Depends on Score and Exposure
The severity labels need context. F5’s CVSS 4.0 vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, which produces 9.2 Critical. Its CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which produces 8.1 High.
Both vectors record network reachability, no required privileges, no user interaction, and high potential impact to confidentiality, integrity, and availability. Both also assign high attack complexity. The NGINX project uses its own major label on the advisory page instead of either CVSS label.
Why the CVSS versions disagree
CVSS 4.0 and CVSS 3.1 use different equations and metric structures, so the same issue can cross a severity boundary without any change to the underlying bug. CVSS 4.0 separates attack requirements from attack complexity, although F5 records no additional attack requirement in its vector. The configuration conditions remain part of the vendor description even though they do not appear as a separate requirement in that vector.
An organization should not lower priority merely because NGINX calls the flaw major, nor should it assume every NGINX server has critical exposure because the CVSS 4.0 score is 9.2. Internet reachability, active configuration, mitigations such as ASLR, traffic volume, and recovery behavior determine local risk. Install the fixed release even if configuration review lowers exposure because the update removes the faulty memory operation.
Which NGINX Versions Are Affected
The affected ranges differ between NGINX Open Source and NGINX Plus. F5 does not evaluate releases that have reached End of Technical Support, so an old branch omitted from the table should not be treated as confirmed safe.
| Product | Affected Versions | Fixed Versions |
|---|---|---|
| NGINX Open Source mainline | 1.31.0 through 1.31.2 | 1.31.3 or later |
| NGINX Open Source stable and older | 0.9.6 through 1.30.3 | 1.30.4 or later |
| NGINX Plus R37 | 37.0.0.1 through versions before 37.0.3.1 | 37.0.3.1 or later |
| NGINX Plus R36 | Versions before R36 P7 | R36 P7 or later |
| NGINX Plus R33 | Evaluated release is affected, with no fixed R33 version listed | Move to a supported fixed branch |
The NGINX 2026 release record confirms that 1.30.4 and 1.31.3 shipped on July 15 with fixes for all three vulnerabilities disclosed that day. Linux distributors may backport the security patch without changing the upstream version number in the way this table suggests. Check the distribution’s package advisory and build revision before declaring a vendor package exposed or fixed.
Containers need the same provenance check. A tag such as stable or latest may resolve to a newer image in the registry while an existing workload keeps running an older digest. Inventory the digest that each deployment currently runs, then rebuild and roll out from a fixed base image.
How to Determine Whether a Server Is Exposed
Start with the running binary rather than a package manifest alone. NGINX documents -v for the version and -V for version plus compiler and configure parameters. Run the commands inside the same host, container, or appliance context that serves production traffic.
nginx -v
nginx -VNext, collect the complete active configuration. The NGINX command-line documentation states that nginx -T tests the configuration and writes the full configuration to standard output, including included files. Protect this output because it can contain internal hostnames, paths, headers, and credential references.
nginx -TReview the output for map blocks that use regex matching, capture variables, composed string values, or the volatile parameter. Do not treat a simple text lookup map as proof of exposure. The affected path depends on the order and behavior of variable evaluation, so a configuration review can raise or lower urgency but should not replace the upgrade.
Check every NGINX deployment form
An inventory should cover public reverse proxies, internal gateways, sidecars, standalone containers, virtual machines, vendor appliances, and application images that bundle NGINX. Confirm whether a Kubernetes ingress product contains NGINX Open Source and which build it uses. A product with NGINX in its name may use different code, release numbers, modules, and vendor fixes.
Also check build pipelines and machine images. Record the fixed digest or package build in deployment policy so the vulnerable release cannot return during scaling or recovery.
How to Patch CVE-2026-42533 Safely
Choose 1.30.4 if the organization follows the NGINX stable branch, or 1.31.3 if it follows mainline. NGINX Plus customers should install the fixed patch release for their supported branch. If an operating system vendor supplies NGINX, use that vendor’s fixed package so dependencies, service files, and backported patches remain consistent.
Test the new binary and configuration in a representative environment. Run nginx -t, exercise routes that depend on maps and regex captures, and verify headers, upstream selection, redirects, access logs, and error handling. A syntax check can confirm that files load, but it cannot prove application behavior across every variable combination.
Roll out gradually where the platform permits it. Watch worker process restarts, error rates, latency, upstream failures, and configuration-specific business checks during the deployment. Preserve the earlier binary or image digest for diagnosis, but do not route ordinary traffic back to a vulnerable release merely because an unrelated application check fails.
NGINX supports configuration reloads that start new workers and allow old workers to finish current requests. After an upgrade, verify the binary used by the master process and confirm that old workers have exited. A successful package installation does not prove that every long-running process or container now uses the fixed code.
What to Monitor After the Upgrade
Look for unexplained worker exits, core dumps, segmentation faults, and repeated service restarts in the period before remediation. These events are useful investigation leads, but they are not unique to CVE-2026-42533. Their absence also does not prove that no exploit attempt reached the server.
Retain request and error logs according to the organization’s incident policy. Correlate any worker failure with the requested virtual host, route, configuration path, deployment version, and upstream response. Avoid publishing a detection rule based on an unverified exploit string because F5 has not provided a universal request signature in its public record.
After deployment, update the asset record with the fixed release, package revision or container digest, test result, and rollout time. Repeat the inventory check for dormant environments and disaster recovery systems. The same release fixes two other July 15 NGINX issues, so include slice and SSI exposure in the closure notes.
The OWASP Open Source Software Top 10 guide explains why version scanning should remain tied to component provenance, deployment state, and response ownership. That broader inventory work keeps a patched CVE from returning through an old image or unmanaged package.
Frequently Asked Questions
Is CVE-2026-42533 a critical NGINX vulnerability?
F5 scores CVE-2026-42533 as 9.2 Critical under CVSS 4.0 and 8.1 High under CVSS 3.1. NGINX labels the issue major on its security advisory index. Local severity depends on the affected version, active map and regex evaluation pattern, network exposure, and platform mitigations.
Does every NGINX server with a map directive need emergency remediation?
The public description requires more than the presence of a map directive. Exposure involves regex captures or certain non-cacheable variable behavior during string expression evaluation. Installing the fixed release is safer than relying on a manual configuration exclusion because the patch protects the underlying copy operations.
Which NGINX versions fix CVE-2026-42533?
NGINX Open Source 1.30.4 stable and 1.31.3 mainline contain the fix. NGINX Plus fixes are 37.0.3.1 for R37 and R36 P7 for R36, while the CVE record lists the evaluated R33 release as affected. Distribution packages may use a backported patch, so confirm the package revision with the distributor.
Is CVE-2026-42533 being actively exploited?
The F5 CVE record did not report exploitation, and its CISA enrichment marked exploitation as none on July 15, 2026. The vulnerability was absent from the CISA Known Exploited Vulnerabilities catalog when this article was checked on July 21. That status can change, so responders should check current vendor and CISA records while patching.