F5 released patches for a critical vulnerability in Nginx, tracked as CVE-2026-42533 with a CVSS score of 9.2, that allows unauthenticated attackers to trigger a heap buffer overflow using specially crafted HTTP requests.
The vulnerability affects Nginx versions from 0.9.6 through 1.31.2 when specific regex-based map configurations are used. An unauthenticated attacker can send crafted HTTP requests to trigger a heap buffer overflow, causing worker process crashes or denial of service. Under certain conditions, particularly if ASLR is disabled or bypassed, the flaw may also allow remote code execution. The issue affects only the data plane and does not expose the Nginx control plane.
Researchers Mufeed VH of Winfunc Research and Maxim Dounin discovered the vulnerability. F5 fixed the issue in Nginx 1.30.4, 1.31.3, and Nginx Plus 37.0.3.1.
Security researcher Stan Shaw noted the flaw’s impact may exceed F5’s initial assessment, potentially enabling ASLR bypass under specific conditions. Shaw released a static configuration scanner that identifies vulnerable Nginx setups without triggering the exploit. He is delaying publication of proof-of-concept code to give organizations time to patch.
As a temporary workaround, administrators can modify affected regex-based map configurations to use named captures instead of numbered captures, though this does not provide complete protection.
