Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

Key Points:

• F5 has released patches for a critical nginx heap buffer overflow vulnerability (CVE-2026-42533) that can be triggered remotely without authentication, potentially causing denial of service or remote code execution if ASLR is bypassed or disabled.
• The flaw exists in nginx's script engine under a specific configuration involving regex-based maps and string expressions, affecting all nginx versions from 0.9.6 through 1.31.2, dating back to 2011.
• The vulnerability was independently reported by multiple researchers, with a detailed analysis suggesting the risk of remote code execution is higher than F5's official advisory states; a proof-of-concept is expected to be released 21 days after the patch.
• Immediate mitigation includes upgrading to nginx 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1, or temporarily switching regex maps to named captures, though the latter is not a complete fix according to security researchers.
• This is the third similar heap overflow in nginx's expression evaluation code disclosed recently, highlighting a recurring design weakness in the two-pass buffer sizing and writing process; no public exploits were available as of July 20, but rapid exploitation is anticipated.