F5 has released patches addressing a critical vulnerability in NGINX, identified as CVE-2026-42533, which could allow remote, unauthenticated attackers to cause a heap buffer overflow in the worker process by sending specially crafted HTTP requests. This flaw affects NGINX versions from 0.9.6 through 1.31.2 and has been resolved in NGINX 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus 37.0.3.1. Users operating on earlier versions are strongly advised to upgrade immediately.
The vulnerability arises from a specific configuration involving the ‘map’ directive with regular expressions. When a regex-based ‘map’ references its output variable in a string expression after capturing from an earlier regex match, the NGINX script engine’s two-pass evaluation process is disrupted. This disruption leads to a buffer overflow, potentially causing the worker process to crash or restart, resulting in a denial-of-service condition. In environments where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, this flaw may also permit remote code execution.
F5 has rated this vulnerability with a CVSS v4 score of 9.2, indicating its critical severity. The issue affects not only the core NGINX server and NGINX Plus but also extends to NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager. As of the advisory’s publication, F5 had not provided fixed builds for these additional products.
Security researcher Stan Shaw, known as cyberstan, has provided a detailed analysis of the vulnerability. He suggests that the flaw could serve as an ASLR bypass mechanism, potentially facilitating remote code execution even on systems with ASLR enabled. Shaw’s findings indicate that the vulnerability could allow an attacker to retrieve uninitialized heap data, including memory addresses, through a single unauthenticated GET request on default Ubuntu 24.04 installations.
To mitigate the risk, users are urged to upgrade to the patched versions of NGINX. For those unable to apply the patches immediately, F5 recommends modifying affected regex ‘map’ configurations to use named captures, which can prevent the exploitation of this vulnerability in most configurations. However, Shaw notes that this mitigation may not cover all potential attack vectors, as certain configurations could still be vulnerable through alternative code paths.
Given NGINX’s widespread use as a web server and reverse proxy, this vulnerability poses a significant risk to internet-facing infrastructure. Administrators should prioritize applying the necessary updates or mitigations to protect their systems from potential exploitation.
