CVE-2026-42533

Published Jul 15, 2026

Last updated 2 months ago

CVSS critical 9.2

Openresty

web application

Port (443)

HTTP

NGINX Plus

NGINX Open Source

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42533 is a heap buffer overflow vulnerability affecting NGINX Plus and NGINX Open Source. This flaw arises when the `map` directive utilizes regular expression matching, and a string expression references the map's regex capture variables prior to referencing the map output variable. The same outcome can also be achieved under specific conditions by employing a non-cacheable variable within a string expression. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests. This can lead to a heap buffer overflow in the NGINX worker process, which may result in a restart of the process. The vulnerability is described as a configuration-dependent worker-process memory corruption issue.

Description: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: f5sirt@f5.com
NVD status: Analyzed
Products: nginx_gateway_fabric, nginx_ingress_controller, nginx_plus, waf

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

f5sirt@f5.com: CWE-122

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE",
            "versionEndIncluding": "1.6.2",
            "versionStartIncluding": "1.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0E26414B-CC24-4618-80C5-4B96013A8920",
            "versionEndExcluding": "2.6.7",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "E54B5C35-49D7-43F6-B57C-4606F75192CE",
            "versionEndIncluding": "3.7.2",
            "versionStartIncluding": "3.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "2156F0F4-1515-45E7-8A13-F653F3796CAF",
            "versionEndExcluding": "5.5.3",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:long-term_support:*:*:*",
            "matchCriteriaId": "95CF6424-294F-41A0-B28C-B35862F3D9E5",
            "versionEndExcluding": "2026-lts-r4",
            "versionStartIncluding": "2026-lts-r1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "109F4C2E-4A5E-4B5E-B282-21AFD52AEC60",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:continuous_releases:*:*:*",
            "matchCriteriaId": "717D820A-78A2-41EF-BB3C-5745B6D954C1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A1E34F4A-5F43-4048-9216-5A8AABD33F72",
            "versionEndExcluding": "37.0.3.1",
            "versionStartIncluding": "37.0.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "87DE2F03-FB1E-48DC-9EEE-B3268BB4C615",
            "versionEndExcluding": "r36",
            "versionStartIncluding": "r33",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*",
            "matchCriteriaId": "E7E5F940-048A-446F-9A1E-074612CEA1AC",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*",
            "matchCriteriaId": "7993A0FB-BE7E-4634-BF7F-FDEE3582D3E7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*",
            "matchCriteriaId": "862EA47E-8D57-434E-9C8F-238325FB85B2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:*:*:*:*",
            "matchCriteriaId": "7B52C01B-F719-4C72-BB83-7B70EC4BC029",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:*:*:*:*",
            "matchCriteriaId": "9F2211E4-93B9-4F1F-BA32-F5C34B879688",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:*:*:*:*",
            "matchCriteriaId": "284E9DB5-02EB-40E9-9DF3-E8F8144775ED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_plus:r36:p6:*:*:*:*:*:*",
            "matchCriteriaId": "0680DC66-0B6F-4E86-B0E6-BCC235A837CE",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "021B6D53-5F4A-4A4B-AC2F-CFBEC338F69F",
            "versionEndIncluding": "4.16.0",
            "versionStartIncluding": "4.11.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "2DB79E6C-08B0-4341-BCBE-B8070DDAA7AF",
            "versionEndIncluding": "5.8.0",
            "versionStartIncluding": "5.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*",
            "matchCriteriaId": "4EA246F7-5222-4403-BFEA-160195FD39B2",
            "versionEndExcluding": "5.13.4",
            "versionStartIncluding": "5.9.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.