Nginx Discloses CVE-2026-42533 RCE Flaw Affecting Versions 0.9.6 Through 1.30.3
Updated
Updated · The Cyber Express · Jul 20
Nginx Discloses CVE-2026-42533 RCE Flaw Affecting Versions 0.9.6 Through 1.30.3
3 articles · Updated · The Cyber Express · Jul 20
Summary
CVE-2026-42533 lets attackers achieve reliable pre-auth remote code execution on nginx using ordinary HTTP requests, with testing reportedly succeeding 10 out of 10 times on Ubuntu 24.04 under ASLR.
The flaw comes from nginx’s two-pass script evaluation engine, where regex map evaluation corrupts shared PCRE capture state and creates both a heap buffer overflow and an information leak.
Versions 0.9.6 through 1.30.3 stable and 1.31.2 mainline are affected, along with NGINX Plus R33-R36 and 37.0.0.1-37.0.2.1; fixes are in 1.30.4, 1.31.3, R36 P7 and 37.0.3.1.
Risk is highest in configurations that combine regex captures with regex map variables across directives such as proxy_pass, rewrite, add_header and access_log, in both HTTP and stream modules.
The researcher urged immediate upgrades, released a non-exploit configuration scanner, and said a proof of concept will be withheld to give defenders time to patch.
After three critical flaws in two months, can NGINX's core script engine still be trusted for modern web security?
With AI finding 15-year-old bugs in NGINX, is critical internet infrastructure far more fragile than we previously thought?
Urgent Security Alert: CVE-2026-42533 Enables RCE in NGINX—Detection, Patching, and Long-Term Defense
Overview
On July 20, 2026, a critical vulnerability known as CVE-2026-42533 was publicly disclosed, posing an immediate and significant threat to NGINX users. This flaw, which had remained hidden in the software since 2011, highlights a persistent weakness in a specific NGINX component. The vulnerability is triggered in configurations that use a regex-based 'map' directive, especially when a variable from this map appears in a string expression alongside a numbered capture from an earlier regular expression, with the numbered capture written before the map variable. This long-standing issue underscores the importance of careful configuration and prompt security action.