A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a…

CVE-2026-42533 is a heap buffer overflow in NGINX's ngx_http_map_module. It triggers when a map directive uses regex matching and a string expression references the map's regex capture variables (e.g. $1, $2) *before* the map's output variable is dereferenced — or when a non-cacheable variable participates in a string expression under specific conditions. The bug has lived in NGINX since 0.9.6 (circa 2011) and covers every version through 1.31.2, with fixes shipped in 1.30.4 (stable) and 1.31.3 (mainline) on 2026-07-15. Both NGINX Open Source and NGINX Plus (F5) are affected.

F5's HIGH / CVSS 8.1 rating is *directionally* correct but over-indexes on the theoretical C:H/I:H/A:H triad. Real-world impact is almost entirely worker-process crash / restart (DoS) because reliable RCE requires ASLR to be disabled or independently bypassed — an increasingly rare posture on any Linux distro shipped after ~2015. The AC:H metric already reflects the config-dependence: your map block has to look a very specific way for the overflow to reach memory the attacker can influence. We assess HIGH 7.2 — the vendor is close, but the config gating and ASLR gating warrant a small downward nudge.

Why this verdict

• Role multiplier: NGINX at the edge (reverse proxy / L7 LB / API gateway) is the canonical high-value role — successful RCE here yields TLS keys, upstream creds, and MITM of every downstream session. Floors verdict at HIGH.
• Unauthenticated remote (PR:N, UI:N): no credentials, no user interaction; any reachable HTTP listener is in scope. Prevents downgrade below HIGH.
• Config-gated trigger (AC:H): only map blocks that reference regex captures *before* the output variable are exploitable — this is not the common map idiom. Prevents upgrade to CRITICAL.
• ASLR gates RCE: worker DoS is guaranteed; code execution requires ASLR disabled or a separate info-leak. Modern distros default to ASLR on. Prevents upgrade to CRITICAL.
• No PoC, not KEV, EPSS unscored: no exploitation pressure justifying an immediate CRITICAL-tier response. Sustains HIGH rather than escalating.

Why not higher?

CRITICAL requires either KEV/active exploitation or a canonical high-value-role chain that succeeds with default configs. Here the trigger is config-shape-dependent (only a subset of map directives are vulnerable) and the RCE branch is ASLR-gated. Absent a PoC and with the DoS-first impact, this does not clear the CRITICAL bar.

Why not lower?

MEDIUM would ignore that NGINX is the internet's most-deployed web server and sits at the trust boundary of tens of millions of estates. Unauthenticated remote heap corruption in an edge component is definitionally HIGH — even without RCE, worker exhaustion of a reverse proxy is a service-outage event for the applications behind it.

1. Upgrade NGINX to 1.30.4 or 1.31.3 within the noisgate SLA — Vendor fix is the definitive remediation — patch by the noisgate HIGH remediation deadline of 180 days. Verify the *running* worker binary via nginx -v, not just package metadata; long-uptime hosts often run pre-restart binaries. Deploy across CDN/edge tier first, origin second.
2. Audit configs for the vulnerable map pattern within 30 days (noisgate HIGH mitigation SLA) — Grep every nginx.conf and included file for map $ blocks that use ~ regex matching AND reference $1/$2/named captures *before* the output variable. Refactor to dereference the output variable first, or replace regex maps with exact-match maps where possible. This eliminates the trigger even on unpatched binaries.
3. Enforce ASLR on every NGINX host — Confirm kernel.randomize_va_space=2 on every worker host — this pushes the vulnerability from RCE-possible to DoS-only. Bake into your baseline CIS/STIG check. Deadline: within the 30-day mitigation window.
4. Enable systemd auto-restart and rate-limit worker respawns — Restart=always with RestartSec= prevents a crashed worker from taking the whole edge offline; combine with StartLimitBurst= to fail-safe under sustained attack. Blunts the DoS impact while patch rolls.
5. Instrument alerting on worker process exited on signal 11 — The only reliable telemetry for exploitation attempts is repeated segfaults in NGINX error.log. Ship error.log to your SIEM and alert on >3 signal-11 events per worker per hour. Deploy within 7 days.

Run on each NGINX host as any user with read access to the binary and config (root recommended for reading /etc/nginx/). Invoke as ./check-cve-2026-42533.sh on the target — no arguments. Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate check for CVE-2026-42533 — NGINX map+regex heap overflow
# Usage: ./check-cve-2026-42533.sh    (run on the NGINX host)
# Exit: 0 PATCHED  |  1 VULNERABLE  |  2 UNKNOWN

set -u

NGINX_BIN="$(command -v nginx || echo /usr/sbin/nginx)"
CONF_DIR="${NGINX_CONF_DIR:-/etc/nginx}"

if [[ ! -x "$NGINX_BIN" ]]; then
  echo "UNKNOWN: nginx binary not found"
  exit 2
fi

# 1) Version check — the running binary, not the package
VER_RAW="$($NGINX_BIN -v 2>&1)"
VER="$(echo "$VER_RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse nginx version from: $VER_RAW"
  exit 2
fi

ver_ge() {
  # returns 0 if $1 >= $2 (semver, 3-part)
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

PATCHED=1
# Fixed: 1.30.4+ on stable branch, 1.31.3+ on mainline
MAJOR_MINOR="$(echo "$VER" | awk -F. '{print $1"."$2}')"
case "$MAJOR_MINOR" in
  1.30) ver_ge "$VER" "1.30.4" && PATCHED=0 ;;
  1.31) ver_ge "$VER" "1.31.3" && PATCHED=0 ;;
  *)
    # any 1.32+ or later branch is fixed; anything <=1.29 is vulnerable
    if ver_ge "$VER" "1.32.0"; then PATCHED=0; fi
    ;;
esac

# 2) Config heuristic — hunt for map+regex+capture-ref-before-output pattern
CFG_HIT=0
if [[ -r "$CONF_DIR" ]]; then
  # crude: any `map $var $out { ... ~... $1|$2 ... }` block
  if grep -REn --include='*.conf' -A20 '^\s*map\s+\$[A-Za-z0-9_]+\s+\$[A-Za-z0-9_]+' "$CONF_DIR" 2>/dev/null \
     | grep -E '~[^{]*.*\$[1-9]' >/dev/null; then
    CFG_HIT=1
  fi
fi

echo "nginx version: $VER"
if [[ $PATCHED -eq 0 ]]; then
  echo "PATCHED: nginx $VER is not affected by CVE-2026-42533"
  exit 0
fi

if [[ $CFG_HIT -eq 1 ]]; then
  echo "VULNERABLE: nginx $VER is affected AND config contains map+regex+capture pattern"
else
  echo "VULNERABLE: nginx $VER is affected (config-shape trigger not detected but binary is vulnerable)"
fi
exit 1

Sources

1. nginx.org 2026 announcements (disclosure)
2. F5 SIRT advisory K000162097
3. nginx security advisories index
4. NGINX Community Forum — 1.30.4 / 1.31.3 release notes
5. LinuxCompatible — 1.31.3 release coverage
6. CVE Record (MITRE)
7. Related — CVE-2026-9256 (rewrite module) context
8. Related — CVE-2026-42945 Akamai analysis (heap overflow class context)