Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
Summary: F5 patched a critical nginx heap buffer overflow, CVE-2026-42533, on July 15 in nginx 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1, with every version from 0.9.6 through 1.31.2 vulnerable. The flaw sits in nginx's two-pass script engine: a regex-based map evaluated between the measuring and writing passes overwrites shared capture state, so the buffer is sized for one capture and filled from an attacker-sized one, crashing workers and, where ASLR is disabled or bypassed, potentially allowing remote code execution.
Bottom line: F5 scores it 9.2 on CVSS v4 and conditions code execution on an ASLR bypass, but reporter Stan Shaw says a single unauthenticated GET on a default Ubuntu 24.04 build recovers the addresses a payload needs, and on July 28 DepthFirst released a full-chain proof-of-concept that bypasses ASLR and redirects cleanup handling to libc's system(). This is the third heap overflow in nginx's expression-evaluation code in about two months, after Rift (CVE-2026-42945), whose exploit went public within days and drew active exploitation soon after.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-42533
- Related
- ⚡ Weekly Recap: Word Press RCE, Sonic Wall 0-Days, AI Service Attacks, Share Point 0-Day and More Cyber Risks ·NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026