Nginx sits in front of a very large share of the world's web applications — as reverse proxy, load balancer or ingress controller. That is exactly why CVE-2026-42533, patched by F5 on July 15, deserves a spot at the top of this week's patching list: a remote, unauthenticated attacker can trigger a heap buffer overflow in the nginx worker process using nothing but crafted HTTP requests.
F5 scores the flaw 9.2 on CVSS v4. The confirmed impact is denial of service — the worker crashes or restarts — but F5 states that where ASLR is disabled or bypassable, remote code execution is possible. One of the reporting researchers, Stan Shaw ("cyberstan"), goes further: he says the same bug leaks uninitialised heap data that hands an attacker the memory addresses a payload needs, making a default Ubuntu 24.04 build exploitable with a single unauthenticated GET. In his words: "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not."
Why this one is different: it depends on your config, not your version
Every nginx release from 0.9.6 through 1.31.2 contains the flawed code — a range going back to 2011. But the bug only becomes reachable under a specific configuration pattern: a regex-based map whose output variable is used in a string expression together with a numbered capture ($1, $2) from an earlier regex match, with the capture written before the map variable.
The root cause sits in nginx's two-pass script engine. The first pass measures how many bytes the result needs and allocates a buffer; the second pass writes the bytes in. Evaluating the map's regex between the two passes overwrites the shared capture state — so the buffer is sized for one value and filled from another, attacker-controlled one. Both the length and the content of the overrun come straight from the request.
This is the third heap overflow in nginx's expression-evaluation code in about two months, after Rift (CVE-2026-42945, exploited in the wild within days of its PoC) and an overlapping-captures bug in the rewrite module (CVE-2026-9256). Same engine, same class of flaw, three different triggers.
What to do now
- Upgrade. Fixed versions are nginx 1.30.4 (stable), 1.31.3 (mainline) and NGINX Plus 37.0.3.1. Note that F5's advisory also lists NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager as affected, with fixed builds still pending at disclosure time — track those separately.
- Audit your configs. The exposure to look for is narrow and greppable: a regex
mapwhose variable appears in a string expression alongside a numbered capture from an earlier regex. The reporting researcher published a config scanner that follows includes and flags only the exploitable ordering. Remember to check every place nginx configs live — containers, ingress definitions and golden images, not just/etc/nginxon long-lived servers.
- If you cannot patch immediately, F5's temporary mitigation is switching affected regex maps to named captures. Be aware of the fine print: the researcher reports a second code path that reaches the same overflow when a map defines the same named group as the location regex. Upgrading is the only complete fix.
- Set a deadline. The PoC is scheduled for release 21 days after the patch. Rift's timeline — public exploit within days, active exploitation soon after — is the realistic template for what happens next.
The NIS 2 angle
If your organization falls under NIS 2, this vulnerability is a neat test case for two obligations at once. First, vulnerability handling: reverse proxies and ingress controllers are internet-facing by design, so a critical pre-auth flaw in them belongs in your fastest patching lane — being one version behind on an edge component is a materially different risk than lagging on an internal app. Second, incident readiness: a crashing worker fleet is a service disruption, and if exploitation leads to a significant incident, the 24-hour early-warning clock starts. Knowing today which systems run nginx, in which versions and configurations, is what makes both obligations achievable.
Would a pentest have caught it?
Not the zero-day itself — but that is not the point. What a good infrastructure penetration test or web security assessment does catch is the surrounding posture that turns a bug like this into an incident: exposed admin interfaces, outdated builds, missing WAF rules, configs nobody has reviewed since 2019, and no inventory of what is actually internet-facing. And when a CVE like this drops, a current vulnerability assessment baseline is what lets you answer "are we affected?" in an hour instead of a week.
If you are not sure whether your nginx estate — or the rest of your edge — has risky configuration patterns, that is a question worth answering before July's PoC arrives. Get in touch and we can help you check.
This article is general information based on public reporting by F5, nginx.org and The Hacker News, not incident-response advice for a specific environment.