F5 Patches CVE-2026-42533 in NGINX 1.30.4, Warning of 9.2-Rated Remote Overflow

2 articles · Updated · The Hacker News · Jul 19

July 15 patches in nginx 1.30.4, 1.31.3 and NGINX Plus 37.0.3.1 fix CVE-2026-42533, a flaw that lets unauthenticated HTTP requests crash workers and potentially achieve remote code execution.
The bug stems from nginx's two-pass script engine: a regex-based map can overwrite shared capture state between buffer sizing and writing, leaving attacker-controlled data to overflow a too-small heap buffer.
Every nginx release from 0.9.6 through 1.31.2 is vulnerable, but only under a narrow configuration pattern; F5 scored the issue 9.2 on CVSS v4 and advised immediate upgrades over temporary workarounds.
Researcher Stan Shaw said the flaw can also leak heap addresses on default Ubuntu 24.04, arguing it may bypass ASLR and make exploitation practical, though he has withheld proof-of-concept code for now.
F5 also listed NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager as affected, but had not published fixed builds for those products by July 20.

Sources

The Hacker News1d ago

F5 Patches Critical NGINX Heap Buffer Overflow Flaw CVE-2026-42533

The Cyber Express1d ago

CVE-2026-42533: Critical Pre-Auth nginx RCE Flaw Found

A researcher claims this new NGINX bug bypasses modern defenses. How vulnerable are the millions of servers running default configurations right now?

With AI finding decade-old flaws in NGINX's core, is patching enough, or is a fundamental rewrite of internet infrastructure now inevitable?

Urgent Security Alert: CVE-2026-42533 in NGINX Script Engine Enables Remote Code Execution and Denial of Service

Overview

A critical vulnerability, CVE-2026-42533, was disclosed and patched in NGINX on July 16, 2026, by F5 and a group of independent researchers. This flaw poses significant risks to web servers worldwide, with the potential to cause severe disruptions such as denial of service and even arbitrary code execution. The vulnerability is rooted in a 'two-pass measure then write' mismatch in the NGINX script engine, making it urgent for administrators to update their NGINX installations immediately. Prompt action is essential to protect systems from these serious threats and maintain secure web operations.

...