- NGINX vulnerability CVE-2026-42533 has been disclosed as a critical pre-authentication remote code execution flaw, allowing attackers to achieve RCE without credentials.
- This 15-year-old vulnerability has been silently exploitable since March 2011, when the `map` directive gained regex support.
- The flaw is rooted in a missing save/restore of PCRE capture state in nginx’s internal script engine, affecting versions 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline).
- Attackers can exploit this vulnerability to trigger a heap buffer overflow and leak sensitive information, enabling reliable RCE.
- Administrators are advised to upgrade immediately to nginx 1.30.4, 1.31.3, or the corresponding patched NGINX Plus releases to mitigate this vulnerability.
- Recent fixes for other nginx bugs do not address this issue, meaning organizations that patched for those flaws remain exposed.
- The researcher has released a static config scanner that identifies vulnerable directive orderings without exploiting anything, giving defenders a way to audit exposure immediately.
- A proof-of-concept exploit exists but will be withheld for 21 days after the patch to allow administrators time to update.
A critical pre-authentication remote code execution vulnerability (CVE-2026-42533) in NGINX has been discovered, allowing attackers to exploit regex patterns to achieve reliable RCE without authentication. This flaw, present since March 2011, stems from a missing save-and-restore mechanism for PCRE capture state within nginx’s two-pass script evaluation engine.56
The vulnerability affects nginx versions 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline), with patched releases including 1.30.4 and 1.31.3. Security researcher Stan Shaw reported the bug to F5 SIRT, which coordinated the fix. The flaw enables attackers to trigger a heap buffer overflow and expose heap pointers through an information leak, defeating Address Space Layout Randomization (ASLR).34
The vulnerability is particularly concerning as it allows for reliable RCE using just one leak request, approximately 40 spray connections, and one overflow-triggering request, achieving a success rate of 10/10 on Ubuntu 24.04 with full ASLR enabled. Affected configurations include regex captures with regex map variables in the same evaluation path, impacting both HTTP and stream modules.
Administrators are urged to upgrade immediately to the patched versions and audit their configurations. The researcher has also released a static configuration scanner to help identify vulnerable setups without exploitation. A proof-of-concept exploit will be withheld for 21 days post-patch release to allow time for updates, following rapid weaponization seen in previous vulnerabilities.7910
“The flaw has been silently exploitable since March 2011 when the map directive gained regex support, and patch releases include nginx 1.30.4, 1.31.3, and corresponding NGINX Plus updates. A static configuration scanner has been released to help administrators audit vulnerable setups without triggering the exploit.”
CyberSecurityNews
The Cyber Express
