A critical vulnerability in NGINX, identified as CVE-2026-42533, has been discovered, allowing attackers to crash worker processes and potentially execute remote code. This flaw has been present since March 2011, when the ‘map’ directive in NGINX was enhanced to support regular expressions.
The issue arises from a missing save/restore mechanism for the PCRE capture state within NGINX’s internal script engine. During request processing, NGINX evaluates expressions in two passes: a length (LEN) pass to determine buffer size and a value (VALUE) pass to write data. Both passes utilize a shared, mutable array called ‘r->captures’. If a ‘map’ directive with a regex pattern executes between two references to a capture group (e.g., ‘$1’), it can overwrite this shared state, leading to discrepancies between the LEN and VALUE passes.
These discrepancies can result in two primary attack vectors:
- Heap Buffer Overflow: If the overwritten capture is larger than the original, the VALUE pass writes more data than the allocated buffer can handle, corrupting adjacent heap memory with attacker-controlled content.
- Information Leak: If the overwritten capture is smaller, the buffer is oversized, potentially leaking uninitialized heap data, including pointers that could help bypass Address Space Layout Randomization (ASLR).
By combining these attack vectors, an attacker can achieve reliable remote code execution. Reports indicate that on systems like Ubuntu 24.04 with full ASLR enabled, this exploit can be executed with high reliability using a minimal number of requests.
The vulnerability affects multiple NGINX configurations, particularly those combining regex capture sources (such as ‘location’, ‘server_name’, ‘rewrite’, or ‘if’ blocks) with regex-based ‘map’ variables evaluated later in the same request context. This includes directives like ‘proxy_set_header’, ‘proxy_method’, ‘proxy_pass’, ‘fastcgi_param’, ‘uwsgi_param’, ‘scgi_param’, ‘grpc_set_header’, ‘return’, ‘add_header’, ‘rewrite’, ‘set’, ‘root’, ‘alias’, and ‘access_log’.
NGINX has released patches to address this vulnerability:
- NGINX Open Source (stable): Versions 0.9.6 through 1.30.3 are affected; fixed in version 1.30.4.
- NGINX Open Source (mainline): Versions up to 1.31.2 are affected; fixed in version 1.31.3.
- NGINX Plus R33–R36: Fixed in R36 P7.
- NGINX Plus (newer line): Versions 37.0.0.1–37.0.2.1 are affected; fixed in 37.0.3.1.
It’s important to note that recent patches for other NGINX vulnerabilities, such as CVE-2026-42945, CVE-2026-9256, CVE-2026-42055, and CVE-2026-48142, do not address this specific issue. Therefore, systems patched for those vulnerabilities may still be at risk.
Interestingly, this behavior was first flagged over a decade ago in a 2014 NGINX trac ticket, where a developer acknowledged it as a design flaw. However, it remained unpatched until now.
This discovery underscores the importance of continuous code review and prompt patching. Organizations using NGINX should apply the latest updates immediately to mitigate potential exploitation risks. Additionally, reviewing configurations for the use of regex-based ‘map’ directives and other affected directives is advisable to ensure system security.
