A critical vulnerability in the popular NGINX web server could allow remote attackers to crash servers and potentially execute malicious code under certain conditions, according to a security advisory released by F5.
Tracked as CVE-2026-42533, the vulnerability affects NGINX’s request-processing engine and allows an unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests. The issue has been patched in the latest NGINX releases, and administrators are urged to update immediately.
F5 released fixes on July 15, 2026, through NGINX 1.30.4 (stable), NGINX 1.31.3 (mainline), and NGINX Plus 37.0.3.1.
Vulnerability Can Cause Denial of Service and Possible Code Execution
Successful exploitation of CVE-2026-42533 can cause NGINX worker processes to crash or restart, resulting in service disruption and potential denial-of-service conditions.
F5 also warned that remote code execution may be possible in environments where Address Space Layout Randomization (ASLR) is disabled or can be bypassed.
The flaw has been assigned a severity rating of 9.2 under CVSS v4 and 8.1 under CVSS v3.1, reflecting its potential impact despite requiring a specific configuration.
Flaw Exists in NGINX Script Processing Engine
The vulnerability affects NGINX’s internal script engine, which dynamically creates strings from configuration directives during request handling.
Researchers found that exploitation requires a specific setup involving a regular expression-based map directive. The vulnerable condition occurs when a map-generated variable is used in a string expression after an earlier regular expression match creates capture values.
The problem originates from NGINX’s two-stage string processing approach. During the first stage, the server calculates the required memory size and allocates a buffer. During the second stage, it writes the generated data into that buffer.
However, both stages rely on shared capture information. If the capture data changes between the two operations, the initial memory calculation becomes incorrect, causing the second stage to write more data than the allocated buffer can hold.
This mismatch creates a heap buffer overflow, with the attacker controlling both the size and content of the overflow through specially crafted requests.
Not All NGINX Deployments Are Vulnerable
The vulnerability does not affect every NGINX installation. Exploitation depends on specific configuration patterns rather than only the software version.
F5 confirmed that affected products include NGINX core software and NGINX Plus, along with related platforms such as NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager.
At the time of disclosure, updated versions for some of these related products had not yet been announced.
The vulnerability impacts a wide range of releases, including versions from NGINX 0.9.6 through 1.31.2, covering more than a decade of software versions.
Researchers Warn of Greater Exploitation Potential
The vulnerability was independently reported by multiple researchers, including security researcher Stan Shaw, who published additional technical analysis of the flaw.
While F5 highlighted denial-of-service risks and conditional code execution possibilities, Shaw suggested that the vulnerability could potentially assist attackers in bypassing memory protections under certain environments.
The researcher stated that exploitation testing showed the flaw could reveal memory information needed for further attacks. However, detailed exploit code and proof-of-concept material have not been publicly released.
Updating Remains the Recommended Fix
F5 recommends upgrading affected installations to:
- NGINX 1.30.4
- NGINX 1.31.3
- NGINX Plus 37.0.3.1
For organizations unable to immediately apply updates, F5 recommends modifying vulnerable regular expression map configurations by using named captures instead of numbered captures.
However, researchers cautioned that this workaround may not cover every possible variation of the vulnerability. Applying the official software updates remains the only complete remediation.
Security Teams Should Review NGINX Configurations
Administrators should review configurations for patterns involving:
- Regex-based map directives.
- Variables used inside string expressions.
- Numbered capture references such as
$1 or $2.
- Capture values generated before map variables are evaluated.
Security experts recommend prioritizing upgrades because previous NGINX memory corruption vulnerabilities have attracted public exploitation after technical details became available.
CVE-2026-42533 was not listed in the CISA Known Exploited Vulnerabilities catalog as of July 20, 2026, and no public exploit code had been released. However, researchers expect interest from attackers once more technical details become available.
The discovery highlights ongoing risks in complex server software and the importance of rapid patching for internet-facing infrastructure.
