Skip to content

OSG-SEC-2026-07-20a NGINX Heap Buffer Overflow Vulnerability (CVE-2026-42533)

NGINX Heap Buffer Overflow Vulnerability (CVE-2026-42533)

Dear OSG Security Contacts,

A vulnerability has been identified in NGINX (CVE-2026-42533) that could allow a remote, unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests to affected servers using certain map directive configurations. Successful exploitation can cause NGINX worker processes to restart, resulting in a denial of service. Under limited circumstances, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, arbitrary code execution may also be possible.

WHAT ARE THE VULNERABILITIES:

CVE-2026-42533 is a heap buffer overflow vulnerability in NGINX's request processing logic. The issue occurs when the map directive performs regular expression matching and a configuration references regex capture variables before the associated map output variable. An unauthenticated attacker can exploit this behavior by sending specially crafted HTTP requests that trigger incorrect buffer sizing during request processing.

The vulnerability is configuration-dependent and does not affect every NGINX deployment. Successful exploitation can cause NGINX worker processes to crash and restart, leading to a denial of service. It affects the NGINX data plane by targeting worker processes that handle HTTP requests and does not expose the NGINX control plane. Although remote code execution has been identified as a potential outcome under specific conditions, Red Hat notes that this risk is significantly reduced on RHEL systems where ASLR is enabled by default.

IMPACTED VERSIONS:

NGINX Open Source
- Versions earlier than 1.30.4 (stable branch)
- Versions earlier than 1.31.3 (mainline branch)

NGINX Plus
- Versions earlier than 37.0.3.1

Red Hat Enterprise Linux
- RHEL 8 nginx AppStream (nginx:1.24) - Affected
- RHEL 9 nginx packages (nginx, nginx:1.24, nginx:1.26) - Affected
- RHEL 10 nginx packages - Affected
- Red Hat has identified the affected packages, but security errata are not yet available.

Debian
- Debian has identified affected nginx packages (Bullseye, Bookworm, Trixie, Forky, and Sid); fixes are not yet available.
Ubuntu
- Ubuntu is evaluating affected packages.

WHAT YOU SHOULD DO:

  • Apply vendor security updates as soon as they become available.
  • Review NGINX configurations that use regex-based map directives to determine whether they are exposed to the vulnerable code path.
  • Replace unnamed regular expression captures (for example, $1, $2) with named captures where practical, and use them only within the same block as the associated regular expression match.
  • Monitor security advisories from your Linux distribution and update affected NGINX packages promptly once fixes are released.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-42533
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-42533
[3] https://www.cve.org/CVERecord?id=CVE-2026-42533
[4] https://my.f5.com/manage/s/article/K000162097
[5] https://security-tracker.debian.org/tracker/CVE-2026-42533
[6] https://ubuntu.com/security/CVE-2026-42533
[7] https://vuldb.com/vuln/379270

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team