A newly disclosed vulnerability tracked as CVE-2026-42533 affects the NGINX script engine and has reportedly remained exploitable for more than 15 years, dating back to March 2011, when regex support was added to the map directive.

Security researcher Stan Shaw discovered the flaw and reported it to F5 SIRT, which coordinated fixes across NGINX Open Source and NGINX Plus releases.

The vulnerability can allow unauthenticated remote attackers to trigger memory corruption, leak sensitive memory contents, and potentially achieve remote code execution (RCE).

What Causes the Vulnerability?

The issue originates from a missing save/restore operation for PCRE capture state within NGINX's internal script engine.

NGINX evaluates expressions in two phases:

  1. LEN Pass – Calculates the required buffer size
  2. VALUE Pass – Writes the actual data

Both phases rely on a shared mutable structure:

r->captures

When a regex-based map directive executes between references to capture variables such as:

$1

the shared capture state is overwritten.

As a result:

  • The LEN pass calculates one size
  • The VALUE pass writes a different amount of data

This discrepancy creates memory safety issues that attackers can exploit remotely.

Two Exploitation Primitives

Heap Buffer Overflow

When the overwritten capture becomes larger than the original value:

  • The VALUE pass writes more data than allocated
  • Adjacent heap memory is corrupted
  • Attackers gain control over overwritten content

This results in a classic heap buffer overflow.

Information Disclosure

When the overwritten capture becomes smaller:

  • The allocated buffer is larger than necessary
  • Uninitialized heap memory is returned in responses

This can expose:

  • Heap addresses
  • libc pointers
  • Memory contents

The leaked information can be used to bypass ASLR protections.

Reliable Remote Code Execution

According to the researcher, combining both primitives enables reliable exploitation.

The reported attack chain requires approximately:

  • 1 information leak request
  • 40 heap spray connections
  • 1 overflow-triggering request

Testing reportedly achieved:

10/10 successful exploitation reliability on Ubuntu 24.04 with full ASLR enabled.

Affected Directives

The flaw is not limited to a single feature.

Researchers identified at least:

  • 13 vulnerable call sites
  • 9 source files
  • HTTP modules
  • Stream modules

Commonly affected directives include:

  • proxy_set_header
  • proxy_method
  • proxy_pass
  • fastcgi_param
  • uwsgi_param
  • scgi_param
  • grpc_set_header
  • return
  • add_header
  • rewrite
  • set
  • root
  • alias
  • access_log

Any configuration that combines:

  1. Regex capture groups
  2. Regex-based map variables

within the same request context may be vulnerable.

Named Capture Variant

Researchers also identified a separate attack path involving named capture groups:

(?P<name>...)

Because named captures are cached differently, a patch addressing only numbered captures may not fully eliminate the risk.

Affected Versions

Product Affected Versions Fixed Version
NGINX Open Source (Stable) 0.9.6 – 1.30.3 1.30.4
NGINX Open Source (Mainline) Up to 1.31.2 1.31.3
NGINX Plus R33 – R36 R36 P7
NGINX Plus 37.0.0.1 – 37.0.2.1 37.0.3.1

Previous Patches Do Not Fix This Issue

Organizations that previously patched for:

  • CVE-2026-42945
  • CVE-2026-9256
  • CVE-2026-42055
  • CVE-2026-48142

remain vulnerable to CVE-2026-42533.

Researchers note that the vulnerability is entirely independent of those issues.

A Known Bug Since 2014

Interestingly, the underlying behavior was reportedly discussed in a 2014 NGINX Trac ticket.

At the time, NGINX developer Maxim Dounin acknowledged the behavior as a defect, but it was never treated as a security vulnerability.

More than a decade later, researchers demonstrated that the bug can be leveraged for full remote code execution.

Defensive Recommendations

Organizations running affected NGINX deployments should:

Upgrade Immediately

Update to:

  • NGINX 1.30.4
  • NGINX 1.31.3
  • Patched NGINX Plus releases

Audit Configurations

Review configurations for:

  • Regex capture groups
  • Regex-based map directives
  • Directive ordering issues

Use the Static Scanner

Researchers released a configuration auditing tool:

0xCyberstan/CVE-2026-42533-Config-Scanner

The scanner identifies potentially vulnerable configurations without attempting exploitation.

Review Location Blocks

Pay particular attention to:

  • location
  • server_name
  • rewrite
  • if
  • map

combinations that reference regex captures before or after map variable evaluation.

Why This Matters

NGINX powers a significant portion of the internet's web infrastructure.

Because CVE-2026-42533:

  • Requires no authentication
  • Enables information disclosure
  • Enables heap corruption
  • Can bypass ASLR
  • Leads to reliable RCE

security teams should treat it as a critical patching priority.

Researchers have intentionally withheld full exploitation details for 21 days to allow organizations time to deploy fixes before weaponized exploits emerge.