Nginx heap buffer overflow remote code execution flaw (CVE-2026-42533)
Vulnerability
Summary
Hide ▲
Show ▼
F5 shipped fixes for CVE-2026-42533, a critical nginx heap buffer overflow that can be triggered by crafted HTTP requests in a specific regex-map configuration. The flaw can crash or restart the worker process, creating denial of service, and F5 says it may also enable remote code execution when ASLR is disabled or bypassed. Affected core versions run from nginx 0.9.6 through 1.31.2, and the fix is available in nginx 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1.
Related Happenings
NGINX web server critical flaws (multiple vulnerabilities)
Vulnerability
H score38
First: 18.06.2026 14:33
Last: 18.06.2026 14:33
Sources 1
About this happening:
NGINX had two critical web server vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that can let remote unauthenticated attackers trigger remote code execution...
NGINX web server critical flaws (multiple vulnerabilities)
VulnerabilityAbout this happening: NGINX had two critical web server vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that can let remote unauthenticated attackers trigger remote code execution...
NGINX rewrite-rule workaround for CVE-2026-42945
Advisory/Mitigation
H score23
First: 14.05.2026 18:43
Last: 14.05.2026 18:43
Sources 1
About this happening:
F5 issued a workaround for vulnerable NGINX rewrite rules, reducing exposure to CVE-2026-42945 for operators who cannot upgrade immediately. The guidance replaces...
NGINX rewrite-rule workaround for CVE-2026-42945
Advisory/MitigationAbout this happening: F5 issued a workaround for vulnerable NGINX rewrite rules, reducing exposure to CVE-2026-42945 for operators who cannot upgrade immediately. The guidance replaces...
NGINX Plus and NGINX Open Source ngx_http_rewrite_module heap buffer overflow remote code execution flaw (CVE-2026-42945)
Vulnerability
H score28
First: 14.05.2026 09:00
Last: 14.05.2026 09:00
Sources 1
About this happening:
CVE-2026-42945 exposes a heap buffer overflow in NGINX Plus and NGINX Open Source through ngx_http_rewrite_module, creating risk of unauthenticated remote co...
NGINX Plus and NGINX Open Source ngx_http_rewrite_module heap buffer overflow remote code execution flaw (CVE-2026-42945)
VulnerabilityAbout this happening: CVE-2026-42945 exposes a heap buffer overflow in NGINX Plus and NGINX Open Source through ngx_http_rewrite_module, creating risk of unauthenticated remote co...
Timeline
-
19.07.2026 23:42 1 articles · 19h ago
F5 releases nginx fixes for CVE-2026-42533
Mitigation Patch UpdateF5 released fixes for CVE-2026-42533 in nginx 1.30.4, nginx 1.31.3, and NGINX Plus 37.0.3.1, and told operators on earlier builds to upgrade. The flaw affects nginx deployments where a specific regex-based map configuration is present, so exposure depends on configuration as well as version.
Show sources
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution — thehackernews.com — 19.07.2026 23:42
-
19.07.2026 23:42 2 articles · 19h ago
F5 discloses CVE-2026-42533 in nginx
Initial DisclosureF5 disclosed that a remote, unauthenticated attacker can use crafted HTTP requests against a vulnerable regex-based map configuration in nginx to trigger a heap buffer overflow in the worker process. F5 said the bug can crash or restart workers for denial of service, and may also allow remote code execution if ASLR is disabled or bypassed; it also listed NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager alongside the core server and NGINX Plus, and recommended switching affected regex maps to named captures as a temporary mitigation.
Show sources
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution — thehackernews.com — 19.07.2026 23:42
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution — thehackernews.com — 19.07.2026 23:42