NGINX CVE-2026-42533: Patch Map Regex Heap Overflow Now

NGINX administrators should treat CVE-2026-42533 as a fast patch item if they run custom map rules with regular expressions. F5 and the NGINX project fixed the flaw on July 15, 2026 in nginx 1.30.4 stable, nginx 1.31.3 mainline, and NGINX Plus 37.0.3.1.¹ The bug can be reached by unauthenticated HTTP requests, but only when the server has the vulnerable configuration pattern. That nuance matters: this is not every NGINX server, but it is serious enough to audit before public exploit details appear.

The official nginx advisory lists the issue as a major buffer overflow when using map and regex, with vulnerable open-source versions from 0.9.6 through 1.31.2 and fixed versions 1.30.4 or 1.31.3 and later.² NVD says the overflow occurs in the worker process when a map directive uses regex matching and a string expression references capture variables before referencing the map output variable. A crafted request can restart the worker, and F5’s CNA score is CVSS 9.2 under CVSS v4.0 and 8.1 under CVSS v3.1.³

There are two practical takeaways. First, the public internet cannot be judged by version number alone. A vulnerable build becomes interesting to attackers when the config combines regex captures, a map, and variable interpolation in the unsafe order. Second, relying on ASLR as the main safety line is a poor bet. F5 describes remote code execution as possible when ASLR is disabled or bypassed; The Hacker News reports that one independent researcher argues the same bug can leak the heap addresses needed for exploitation on default Ubuntu 24.04 builds, although those exploit details are being withheld for now.⁴

What NGINX teams should check first

Start with the boring inventory work: find exposed NGINX and NGINX Plus instances, confirm their exact builds, and plan updates to 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1. If you maintain Kubernetes ingress or F5-packaged NGINX components, review F5’s product advisory separately because downstream product fix status can differ from the open-source nginx release cadence.¹

For configuration triage, search the active config tree rather than only the main file. Include files under conf.d, virtual-host directories, and generated config fragments from deployment tooling. Look for regex-based map blocks and places where numbered captures such as $1 or $2 are mixed into a string before a map variable is evaluated. If you cannot patch immediately, F5’s mitigation is to replace unnamed regex captures with named captures in affected map or slice usage, but upgrading is the cleaner fix because mitigation coverage can be configuration-dependent.⁴

A compact first pass is to run nginx -T on a staging or maintenance shell, save the expanded configuration, and review suspicious map and regex capture combinations. Do not paste production secrets or private hostnames into public scanners. If you use a third-party scanner, run it locally against the exported config and verify what it flags before changing live routing rules.

Operations teams should also watch for symptoms that look like ordinary instability: repeated worker exits, unexplained restarts under traffic, and error-log entries clustering around specific endpoints. Those signs do not prove exploitation, but they should move the host into a higher-priority patch lane. Because the flaw is data-plane reachable rather than a management-console issue, edge and reverse-proxy nodes deserve attention even when administrative panels are locked down.

HowToFix readers who followed the earlier June NGINX RCE patch guidance should not assume that work covers this issue. CVE-2026-42533 is a new map/regex condition fixed in the July 15 release train. It is also related in spirit to the earlier exploited NGINX rewrite-module flaw: both reward attackers who understand how request-time expressions are assembled. For teams maintaining mixed web stacks, the same urgency logic applies to other internet-facing server flaws such as the recent Apache HTTP Server HTTP/2 RCE risk.

As of July 20, 2026, CVE-2026-42533 was not listed in CISA’s Known Exploited Vulnerabilities catalog, and public exploit code had not been confirmed by the sources reviewed for this article.⁴ That should not be read as permission to wait. The patch is already out, the affected version range is broad, and The Hacker News reports that a proof-of-concept may be published 21 days after the fix. The safer window is before defenders and attackers are both working from the same exploit notes.