"A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Stan Shaw (publishing as cyberstan) told The Hacker News.
What the flaw does inside nginx's script engine
F5 disclosed a critical nginx vulnerability, tracked as CVE-2026-42533, that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. The overflow arises in nginx's script engine — the component that assembles strings from directives at request time — and only appears under a narrowly defined configuration pattern.
nginx's script engine evaluates expressions in two passes. The first pass measures how many bytes the result will need and allocates a buffer sized to that measurement; the second pass writes the bytes into the buffer. When a regex-based map's output variable is referenced in a string expression after a capture from an earlier regex match, evaluating the map's regex between the two passes can overwrite the shared capture state. The measuring pass therefore sizes a buffer for the original capture (for example, a reference like $1), while the writing pass fills it from a different, attacker-controlled capture. The result is a buffer too small for the written data; both the length and the content of the overrun come directly from the request.
Scope: versions, products, and scores
F5 reports that every nginx version from 0.9.6 through 1.31.2 is vulnerable — a range that reaches back to 2011, the year nginx's map gained regex support. Patches were shipped on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; F5's advisory urges anyone on earlier builds to upgrade.
F5 lists the flaw as affecting the core server and NGINX Plus, and also names NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager alongside those products; as of publication F5 had not listed fixed builds for those four downstream products. F5 scores the issue 9.2 on CVSS v4 and 8.1 on CVSS v3.1, and rates attack complexity high.
Denial-of-service versus remote code execution: the dispute
F5's advisory states that triggering the overflow can crash or restart a worker, causing a denial of service; it adds that where address space layout randomization (ASLR) is disabled or can be bypassed, the bug may also allow remote code execution. Multiple independent reporters — more than a dozen researchers, F5 says — reported the issue to the vendor.
Stan Shaw goes further than F5. He told The Hacker News that the capture clobbering can itself supply an ASLR bypass. Shaw says that when the clobbered capture is smaller than the original, the oversized buffer can hand back uninitialized heap data; on a default Ubuntu 24.04 build, he reports, a single unauthenticated GET recovers the addresses a payload needs. Shaw said his testing scored exploitation feasibility "10 out of 10," and he is withholding exploitation details and a proof-of-concept for now. He told The Hacker News he will publish his proof-of-concept 21 days after the patch.
Patches, mitigations, and remaining paths
The complete fix, F5 and the nginx changelog say, is to upgrade to nginx 1.30.4 or 1.31.3, or to NGINX Plus 37.0.3.1. As a temporary mitigation for those who cannot patch immediately, F5 recommends switching affected regex maps to named captures. Shaw concurs that named captures close the main path and cover most configurations, but he also reported a narrower remaining path: a map that defines the same named group as the location regex can reach the same overflow through a second code path. Shaw confirmed that variant with AddressSanitizer; F5's advisory does not mention it. "Upgrading to 1.30.4 / 1.31.3 is the only complete fix," Shaw said. The Hacker News asked F5 whether switching to named captures fully closes CVE-2026-42533 and when fixes for downstream products will ship; F5 had not responded by publication.
How operators, downstream product owners, and security teams should react
- NGINX operators and security teams should prioritize upgrading to nginx 1.30.4 or 1.31.3 (or NGINX Plus 37.0.3.1) where possible, because both the vendor and independent researchers identify upgrade as the only complete remediation.
- Owners of NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager deployments should inventory affected versions and configurations and track F5 for fixed downstream builds; F5's advisory names those products as affected but had not, at publication, listed fixed builds for them.
- Enterprise vulnerability and patching teams should scan configurations for the narrow exposure pattern — a regex-based map whose variable appears in a string expression alongside a numbered capture ($1, $2) from an earlier regex where the capture is written before the map variable — and consider named-capture mitigations only as a stopgap, per Shaw's findings.
This is the third heap overflow disclosed in nginx's expression-evaluation code in roughly two months, following Rift (CVE-2026-42945) in May and an overlapping-captures bug in the rewrite module (CVE-2026-9256) days later. All three stem from the same two-pass design: a measurement pass that sizes a buffer and a write pass that can outrun that measurement when shared state changes between passes. With one reporter planning a public proof-of-concept and a recent precedent of rapid public exploit availability, the immediate imperative is clear: upgrade now where you can, and apply named-capture mitigations while tracking vendor fixes for downstream products.
Source: The Hacker News — Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
