CVE-2026-42533: 15-Year nginx Pre-Auth RCE Exposed

Security researcher Stan Shaw disclosed a 15-year-old critical flaw in the nginx script engine. A remote unauthenticated attacker can achieve pre-auth RCE via heap buffer overflow, affecting versions 0.9.6 through 1.30.3.

On 15 July 2026, F5/NGINX patched CVE-2026-42533, a pre-auth RCE in the nginx script engine. The defect has been present since 0.9.6 added regex support to the map directive and yields heap overflow without authentication.

Incident Overview

On 15 July 2026, the F5/NGINX team released a security update for a critical vulnerability disclosed by researcher Stan Shaw (handle Cyberstan): CVE-2026-42533. The bug lives in the nginx script engine's internal expression evaluation path and lets a remote unauthenticated attacker achieve pre-auth remote code execution (Pre-Auth RCE) via a heap buffer overflow.

More striking: the defect has existed since 21 March 2011, when nginx 0.9.6 added regex support to the map directive — a 15-year window. Affected versions cover nginx 0.9.6 through 1.30.3 (stable) / 1.31.2 (mainline), plus NGINX Plus R33 through R36 and 37.0.0.1 through 37.0.2.1.

Technical Details

Root Cause: Fatal Flaw in the Two-Pass Evaluation Model

When compiling expressions that contain variable references, the nginx script engine uses a two-pass evaluation model:

• LEN Pass: walk the opcode sequence, sum character lengths of each fragment, allocate a buffer of that exact size

• VALUE Pass: walk the same opcode sequence and write actual content into the allocated buffer

The design assumes each opcode produces identical length in both passes. That assumption fails when an expression contains both regex capture groups (e.g. `$1`) and regex map variables.

Capture State Clobbering

When a location block uses a regex match, results land in the request object's `r->captures`. These fields are shared mutable state — any later regex match overwrites them; the original context is neither saved nor restored.

When a map directive uses a regex pattern, evaluating the map variable calls `ngx_http_regex_exec()`, which writes results straight into the request's capture state and clobbers the original location-match captures. LEN and VALUE then disagree on the size of `$1`:

• Heap overflow: if the clobbered capture is larger than the original, VALUE writes past the buffer

• Info leak: if the clobbered capture is smaller, the buffer is oversized and the response leaks uninitialized heap (libc and heap pointers, enough to bypass ASLR with a single GET)

Attack Surface and Reliability

Per Cyberstan, the bug spans at least 13 independent call sites across 9 source files, hitting both HTTP and stream modules. An attacker needs about 1 leak request, 40 spray connections, and 1 overflow trigger to get 10/10 reliable RCE on Ubuntu 24.04 with full ASLR.

Stan Shaw said a full POC will drop 21 days after the patch (around 5 August). CVE-2026-42945 (nginx Rift, a weaker sibling that needed ASLR off for reliable exploit) was exploited in the wild shortly after its POC went public.

Impact Assessment

nginx is among the most widely deployed web servers and reverse proxies, carrying a large share of internet traffic. Impact factors:

• No auth: any remote attacker who can reach the nginx service can exploit it

• Config-dependent: triggerable only when a config has both a regex capture source and a regex map variable

• High reliability: the leak primitive bypasses ASLR in a single GET

• Broad surface: 13 call sites across HTTP and stream; many common directives affected

Remediation

Upgrade Immediately

• stable: nginx 1.30.4 or later

• mainline: nginx 1.31.3 or later

• NGINX Plus: R36 P7 or 37.0.3.1 and later

Note: builds that only patched CVE-2026-42945, CVE-2026-9256, CVE-2026-42055, and CVE-2026-48142 do not fix this issue. Upgrade again.

Config Scanning and Mitigation

Exposure depends on config, not version alone. Run Stan Shaw's static config scanner:

# Install the config scanner
git clone https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner
# Scan production config
python3 scanner.py /etc/nginx/nginx.conf --json

If you cannot patch immediately, manually check configs for:

• any map directive that uses a regex pattern

• the map variable referenced in the same location block or request context as an earlier regex capture group (e.g. `$1`)

Temporary mitigation: convert affected regex maps to named capture groups (`(?<name>...)`); named captures are not affected.

References

• Cyberstan: original CVE-2026-42533 technical analysis

• TechTimes: nginx Map Regex RCE public scanner and patch timeline

• Xpert4Cyber: CVE-2026-42533 detection and mitigation guide

• Tencent Security: deep dive on the 15-year nginx bug