DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-42533: CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak

#security #cve #cybersecurity

CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak

Vulnerability ID: CVE-2026-42533
CVSS Score: 9.2
Published: 2026-07-15

CVE-2026-42533 is a critical security vulnerability discovered in NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and related products, referred to as the 'Two-Pass Capture-Clobbering' bug. The flaw is situated within NGINX's internal evaluation engine when handling complex variables, exposing a heap-based buffer overflow and information leak when a configuration chains regular expression-based map directives with numbered capture groups. An unauthenticated remote attacker can exploit this weakness by transmitting crafted HTTP requests to trigger remote code execution or defeat ASLR.

TL;DR

A pre-authentication heap buffer overflow and ASLR bypass in NGINX caused by regex capture state clobbering, permitting remote code execution under specific map configurations.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-119 / CWE-122
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1 Score: 8.1 (High)
  • CVSS v4.0 Score: 9.2 (Critical)
  • Exploit Status: Proof-of-Concept / Weaponized Exploit Available
  • CISA KEV: No

Affected Systems

  • NGINX Open Source (Stable and Mainline)
  • NGINX Plus
  • NGINX Ingress Controller
  • NGINX WAF
  • NGINX Gateway Fabric
  • NGINX Open Source (Stable): 0.9.6 to 1.30.3 (Fixed in: 1.30.4)
  • NGINX Open Source (Mainline): 0.9.6 to 1.31.2 (Fixed in: 1.31.3)
  • NGINX Plus: R33 to R36 (up to P6) (Fixed in: R36 P7 / 37.0.3.1)

Exploit Details

  • GitHub: 0xCyberstan Exploit PoC Repository for Pre-Auth RCE and ASLR Bypass
  • GitHub: imbas007 Diagnostic, Crash, and Leak Exploit Script

Mitigation Strategies

  • Upgrade NGINX binaries to the patched versions immediately.
  • Refactor NGINX configurations to utilize named capture groups rather than numbered capture groups within regular expressions.
  • Monitor system error logs for NGINX worker process exit signals, particularly SIGABRT (signal 6) and SIGSEGV (signal 11).

Remediation Steps:

  1. Scan existing NGINX configuration files for regex-based map directives containing numbered capture references.
  2. Verify matches against the complex-value sink criteria where map variables and numbered captures are combined.
  3. Apply updates to stable/mainline packages or deploy patched vendor containers.
  4. In situations where updating is delayed, rewrite configurations to utilize named groups like (?...) to bypass the vulnerable global captures array.
  5. Reload the NGINX configuration using 'nginx -s reload' and verify functionality.

References

Read the full report for CVE-2026-42533 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)