A critical heap buffer overflow vulnerability, identified as CVE-2026-42533, has been discovered in NGINX Plus and NGINX Open Source. This flaw enables unauthenticated attackers to crash worker processes and, under certain conditions, execute arbitrary code remotely.
Technical Details
The vulnerability arises when configurations utilize regex-based map directives or non-cacheable variables within string expressions. Specifically, it occurs when a map directive employs regex matching, and a string expression references the map’s regex capture variables before the map output variable. This sequence can lead to a heap buffer overflow in the NGINX worker process, resulting in a restart. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the overflow may escalate to remote code execution.
The root cause lies within NGINX’s internal script engine, which evaluates complex values in two passes. The first pass calculates the total length of the result, while the second copies data into a heap buffer of that size. If a regex-based variable, such as one produced by a map, is evaluated between these passes, it can update the global capture state. Consequently, the second pass may copy more data than allocated, leading to a buffer overflow.
Impact and Exploitation
In the Stream module, the ssl_preread feature extracts TLS handshake fields, such as the Server Name Indication (SNI), into variables often used in complex values. This process occurs before TLS termination, exposing the attack surface to unauthenticated clients. An attacker can exploit this by sending a crafted TLS ClientHello with a specific SNI to a stream listener with ssl_preread enabled and a configuration that evaluates regex captures inside a complex value. This can cause the length calculation to underestimate the final size, leading to a heap overflow during the copy step.
Security researchers have noted that this bug can provide both information-leak and out-of-bounds write primitives, facilitating ASLR bypass and reliable exploitation on vulnerable systems.
Mitigation and Recommendations
F5 published a security advisory on July 15, 2026, addressing this vulnerability. Organizations using NGINX Plus or Open Source with stream blocks, ssl_preread, or regex-based maps should prioritize applying the provided patches. Until updates are applied, reducing exposure of stream listeners to untrusted networks, avoiding regex capture references in complex values before map outputs, and ensuring ASLR remains enabled can mitigate risk.
Administrators should monitor official F5 and NGINX channels for fixed releases and apply them promptly. After updating, it’s crucial to validate that worker processes no longer crash under malformed ClientHello or HTTP traffic.
This vulnerability underscores the importance of thorough configuration reviews and prompt patching in maintaining the security of web servers. Organizations should remain vigilant and proactive in addressing such critical flaws to protect their infrastructure from potential exploits.
