F5 has shipped a fix for a critical nginx flaw that allows a remote, unauthenticated attacker to trigger a heap buffer overflow in a worker process with crafted HTTP requests. CVE-2026-42533 On July 15, nginx 1.30.4 (stable) and 1.31.3 (mainline), and NGINX Plus was patched to 37.0.3.1; Anyone on an earlier build should upgrade.
Triggering this may cause the worker to crash or restart, causing a denial of service; Where ASLR is disabled or can be bypassed, F5 says it can also allow remote code execution.
The overflow resides in nginx’s script engine, the code that assembles strings from directives at request time. This only comes up under a specific configuration: a regex-based map Whose output variable is referenced in a string expression after capture from an earlier regex match.
Under that pattern the two-pass evaluation of the engine falls apart. The first pass measures how many bytes the result needs and allocates a buffer to fit; The second pass writes the bytes. Both read the same shared capture state, and evaluating the map’s regex between the two passes overwrites it.
So the measuring pass shapes the buffer for the original capture, like a reference $1 By matching the location, while the write pass fills it with a different, attacking shape. The buffer is very small, and both the length and content of the overrun come directly from the request.
This does not affect every nginx server; Exposure depends on configuration, not just version. F5’s advisory lists the flaw as affecting Core Server and NGINX Plus, as well as NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager, though F5 did not list fixed builds for those four products in the publication.
F5 gives it a score of 9.2 on CVSS v4 and 8.1 on the older v3.1 scale, and rates the attack complexity higher. Every nginx version from 0.9.6 to 1.31.2 is vulnerable, a limit reached in 2011, when map Regex support gained.
CVE-2026-42533 was independently reported to F5 by more than a dozen researchers; The seller thanked them for “independently bringing this issue to our attention.” nginx’s own changelog attributes the issue to Mufeed VH of Winfunc Research and maintainer Maxim Dounin.
One of the journalists, stan shawwho publishes as cyberstanWrite a detailed article that goes beyond advice. The F5 state makes code execution on ASLR disableable or bypassable, and Shaw’s contention is that the flaw supplies the bypass itself. He told The Hacker News that capture clobbering also works in the opposite way: when the clobbered capture is smaller than the original, the larger buffer size returns uninitialized heap data, and the default on Ubuntu 24.04 produces a single uninitialized GET that retrieves the address requiring the payload.
Shaw said, “A reader of the F5 advisory could reasonably conclude that this is DoS only on default systems. This is not the case.” This is a stronger claim than F5, he says he hit 10 out of 10 in his testing, and he’s withholding exploit details and proof of concept for now, so no one can test it independently yet.
The solution is to upgrade to nginx 1.30.4 or 1.31.3, or NGINX Plus 37.0.3.1. For anyone who can’t patch immediately, F5’s temporary mitigation is to switch the affected regex maps to named captures, which Shaw says closes the main path and covers most of the configuration.
But he told The Hacker News that the mitigation leaves a narrow path open: a map This defines the same named group as the location regex reaching the same overflow via another code path, which they confirmed with AddressSanitizer and which is not mentioned in F5’s advice. “Upgrading to 1.30.4/1.31.3 is the only complete solution,” he said.
Grep for’s exposure is narrow: a regex-based map whose variable appears in a string expression with numbered captures ($1, $2) From the earlier regex, capture is written in front of the map variable.
Shaw’s own scanner automates checks in one configuration, includes, and flags only exploitable orders; It doesn’t exploit anything, but as a reporter’s tool it’s not a vendor’s product.
Rift (CVE-2026-42945) in May and an overlapping-capture bug in the rewrite module (CVE-2026-9256) days later.
All three are the same category of flaws: nginx’s two-pass script engine sizes a buffer in one pass and writes to it in the next, and each time the write exceeds the size it measured. Trigger is different, an old flag in Rift, overlapping captures in rewrite bug, clobbered capture situation here. As the researchers note, shared frailty is a two-pass design that relies on its own measurement.
As of July 20, CVE-2026-42533 was not on CISA’s list of known exploited vulnerabilities and no public exploit code had been revealed. Shaw says he’ll publish his own proof of concept 21 days after the patch, and Rift is a cautionary case in point: Its exploit went public within days and active exploitation began shortly thereafter. That’s all the reason to upgrade before it arrives.
Hacker News asked F5 whether switching to named capture completely stops CVE-2026-42533, looking at the variant Shaw documents, and when the fixed build will be shipped for affected downstream products. F5 had not responded by publication.
