CVE-2026-42533: Critical Vulnerability in NGINX Due to a Heap Buffer Overflow
This text was generated using artificial intelligence (AI).On July 15, 2026, a critical security vulnerability was disclosed in the widely used NGINX web server. The vulnerability, identified as CVE-2026-42533 This vulnerability affects both NGINX Open Source and NGINX Plus and, under certain circumstances, allows attackers to launch denial-of-service (DoS) attacks and potentially execute malicious code (Remote Code Execution, RCE).
The vulnerability is classified as a heap buffer overflow and was assigned a CVSS 3.1 score of 8.1 (High) rated — according to the newer CVSS v4.0 scale, even at 9.2 (Critical). It is triggered by specially crafted HTTP requests, but only if a specific, non-standard server configuration is used. Patches are available and should be applied immediately.
Technical Background and Attack Vector
The error occurs during the processing of regular expressions within the map-NGINX directive. An attacker can cause a buffer overflow in the NGINX worker process's heap memory by sending a targeted HTTP request. The immediate consequence is usually a crash and automatic restart of the process, resulting in a temporary denial of service (DoS).
The greater risk lies in the potential for remote code execution. According to the advisory from F5, the company behind NGINX, successful code execution depends on additional factors, such as Address Space Layout Randomization (ASLR) being disabled. However, Stan Shaw (cyberstan), one of the primary reporters of the vulnerability among more than a dozen independent researchers, notes that the flaw itself could enable information disclosure that could be used to bypass ASLR.
A key factor in assessing the risk is that not every NGINX instance is vulnerable. Exploitation depends on a specific configuration in the configuration file: The map-The directive must use regular expressions in which a capture variable is referenced in the string expression before the map's output variable is evaluated in the same expression. Standard configurations are typically not affected by this. This dependency makes identifying vulnerable systems a task that goes beyond a simple version scan and requires an analysis of the configuration.
It is also worth noting that CVE-2026-42533 is already the third heap overflow in Nginx's Script engine within about two months—following CVE-2026-42945 („Rift“) in May 2026 and the overlapping capture bug CVE-2026-9256 a few days later. This recurring pattern in the same section of code is a significant indicator of the structural risk posed by NGINX-dependent supply chains.
Affected Versions and Recommended Actions
To fix the vulnerability, affected NGINX installations must be updated to a patched version. The complete F5 Security Advisory K000162097 contains version-specific details.
Affected software versions:
- NGINX Open Source: 0.9.6 to 1.31.2
- NGINX Plus: R33 through R36 (before P7) and 37.0.0.1 through 37.0.2.1
Corrected software versions:
- NGINX Open Source: 1.31.3 (Mainline) or 1.30.4 (Stable) and later
- NGINX Plus: R36 P7 or 37.0.3.1 and later
Recommendations for Action:
- Priority 1: Perform the upgrade: The only way to fully resolve this vulnerability is to upgrade to one of the fixed versions listed above.
- Check configurations: Administrators should check their NGINX configurations for the described, vulnerable use of the map-Check the directive. A community-provided Configuration Scanner can help with identification.
- Temporary Relief: As a temporary solution, you can switch from unnamed to named regex captures in the map-directives to reduce the risk. However, according to the researchers, this workaround does not fully close the vulnerability.
- Monitor dependent products: F5 has announced that other products, such as the NGINX Ingress Controller and possibly other F5 products, may also be affected—for the App Protect WAF and similar components, it is recommended to monitor the official F5 advisories for updates.
Relevance for Organizations in Germany, Austria, and Switzerland
For companies and government agencies in German-speaking countries, there are several regulatory considerations to keep in mind in the event of a successful attack exploiting CVE-2026-42533: If personal data is compromised as a result of an RCE exploit, the reporting obligation under Article 33 of the GDPR applies—the competent data protection authority must be notified within 72 hours. Operators of critical infrastructure (KRITIS) and companies falling within the scope of the NIS 2 Directive are also required to proactively manage cyber risks in the supply chain, which includes promptly patching known vulnerabilities in third-party components in use. The BSI generally recommends installing security updates for exposed web server components immediately.
Vulnerability Management with LocateRisk
Protection against threats such as CVE-2026-42533 requires complete visibility into one’s own externally accessible IT infrastructure. Often, it is forgotten or undocumented systems (shadow IT)—such as subdomains that are no longer actively maintained, untracked cloud assets, or servers that have been removed from the inventory—that remain unpatched and serve as a gateway for attacks.
An External Attack Surface Management (EASM) solution, such as the LocateRisk platform, provides the necessary foundation here. The solution continuously identifies all of a company’s publicly accessible systems and services, including all NGINX instances. By detecting the versions in use, IT security teams can specifically identify those servers that are potentially affected by the vulnerability and prioritize their remediation.
In the context of Vendor Risk Management (VRM), the platform also helps assess the digital supply chain. Companies can verify whether critical service providers or partners are running vulnerable versions of NGINX, which could pose a risk to their own organization. The recurring pattern of serious NGINX vulnerabilities underscores why continuous monitoring of third-party infrastructure—rather than one-time audits—is an essential component of a robust VRM program. This approach supports compliance with regulations such as NIS-2, which require proactive management of cyber risks in the supply chain. The LocateRisk platform is a “Made in Germany” solution designed for GDPR compliance and hosted in certified German data centers.
Sources and further information
Frequently asked questions
No. CVE-2026-42533 is configuration-dependent and occurs only if the map-directive is used with regular expressions, and a capture variable is referenced in the string expression before the map's output variable is evaluated in the same expression. Default configurations without this specific use of the map-Directives are not affected.
For NGINX Open Source, versions 1.31.3 (Mainline) and 1.30.4 (Stable), as well as all newer releases, are no longer vulnerable. For NGINX Plus, R36 P7 and 37.0.3.1, as well as newer versions, address the vulnerability. All earlier versions starting with NGINX Open Source 0.9.6 or NGINX Plus R33 are considered potentially affected.
As of July 20, 2026, CVE-2026-42533 is not listed in the CISA Known Exploited Vulnerabilities Catalog, and no public exploit code has been released. Researcher Stan Shaw has announced that he will publish his proof-of-concept approximately 21 days after the patch is released—that is, around August 5, 2026. An immediate upgrade to a patched version is therefore strongly recommended.
English 
Deutsch 
Français