Critical NGINX Vulnerability Exposes Millions of Servers to Remote Code Execution

A Critical NGINX Flaw That Has Been Hiding Since 2011

A severe security vulnerability in NGINX — one of the world's most widely deployed web servers and reverse proxies — has been patched after researchers discovered it could allow remote, unauthenticated attackers to crash servers or, under certain conditions, execute arbitrary code. The flaw, tracked as CVE-2026-42533 and scoring 9.2 on the CVSS v4 severity scale, affects every version of NGINX from 0.9.6 through 1.31.2 — a range that stretches back to 2011. For developers, infrastructure engineers, and IT decision-makers running NGINX in production, this is an immediate action item.

F5, the company that maintains NGINX, issued patches on July 15 in two releases: NGINX 1.30.4 (stable branch) and 1.31.3 (mainline branch), as well as NGINX Plus version 37.0.3.1. The underlying flaw is a heap buffer overflow buried in NGINX's internal script engine — the subsystem responsible for assembling dynamic strings from configuration directives at request time. Under a specific but not uncommon configuration involving regex-based maps and capture groups, an attacker can send a crafted HTTP request that causes the buffer to overflow, potentially destabilising or fully compromising the worker process.

The vulnerability was independently reported to F5 by more than a dozen security researchers, an unusually high number that underscores how closely scrutinised NGINX's codebase has become. NGINX powers an estimated 30–34% of the world's web servers, according to W3Techs web server survey data, making any critical flaw in its core engine a systemic risk for cloud infrastructure, API gateways, and internet-facing applications worldwide.

How the Two-Pass Engine Creates a Dangerous Race Condition

Understanding why this NGINX vulnerability remote code execution risk exists requires a brief look at how NGINX handles string assembly internally. The engine uses a two-pass approach: the first pass measures how many bytes the final output string will require and allocates a buffer of exactly that size; the second pass writes the actual data into that buffer. Both passes read from shared capture state — the regex match groups like $1, $2 — stored in memory.

The problem surfaces when a configuration uses a regex-based map directive whose output variable is referenced in a string expression that also includes a numbered capture from an earlier regex match. When the map's own regex is evaluated between the two passes, it overwrites the shared capture state. The first pass measured the buffer size based on one capture value; the second pass writes a different, attacker-controlled value. The result: the written data exceeds the allocated buffer, overflowing into adjacent heap memory.

Crucially, both the length and the content of the overrun come directly from the attacker's HTTP request. This is not a theoretical edge case — it is a deterministic overflow that an attacker can craft deliberately. The immediate consequence is a denial of service: the NGINX worker process crashes or restarts. But the severity goes further.

F5's own advisory states that code execution is possible where Address Space Layout Randomisation (ASLR) is disabled or can be bypassed. But researcher Stan Shaw, publishing as cyberstan, goes substantially further in his own detailed writeup. Shaw argues that the overflow itself supplies the ASLR bypass: when the clobbered capture is smaller than the original, the oversized allocated buffer hands back uninitialised heap data — essentially leaking memory addresses that a subsequent payload needs to target the correct memory location. On a default Ubuntu 24.04 system, Shaw reports that a single unauthenticated GET request was sufficient to recover the necessary addresses in his testing.

Shaw reports a 10-out-of-10 success rate in his own testing, and is withholding the exploitation details and proof-of-concept code for now, meaning independent verification is not yet possible. He has indicated he will publish his proof-of-concept 21 days after the patch release.

Which NGINX Products and Configurations Are Actually Exposed?

Not every NGINX deployment is vulnerable — exposure depends heavily on configuration, not just version. The specific trigger requires a regex-based map block whose output variable is used in a string expression alongside a numbered capture group (such as $1 or $2) from an earlier regex match, with the capture written before the map variable in that expression. Administrators can audit their configs by looking for this pattern.

Beyond the core NGINX server, F5's advisory lists several downstream products as affected: NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF, and NGINX Instance Manager. For organisations running Kubernetes clusters behind NGINX Ingress Controller — a common pattern in cloud-native architectures — this significantly broadens the attack surface. Notably, at the time of publication F5 had not yet listed fixed builds for those four downstream products, leaving a gap for enterprise users who depend on them.

Why the Official Mitigation May Not Be Enough

For teams that cannot immediately upgrade — perhaps due to change-freeze windows, staging pipelines, or dependency constraints — F5 recommends a temporary mitigation: convert affected regex map captures from numbered groups to named captures. This is a configuration-level change that closes the primary exploitation path and, F5 says, covers the majority of vulnerable configurations.

However, Shaw's research identifies a second code path that the mitigation does not address. A map that defines the same named capture group as the location regex can reach the same underlying overflow through a different route, which Shaw confirmed using AddressSanitizer — a memory-error detection tool used in software testing. This variant is not mentioned in F5's advisory, and F5 had not responded to questions about it at the time the original report was published.

The practical conclusion is clear: the named-capture workaround reduces risk for most deployments but is not a complete fix. The only fully reliable remediation is upgrading to NGINX 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1. Shaw's own scanner tool, built as part of his research, can help teams audit their configurations — it follows include directives, identifies the specific exploitable ordering of captures and map variables, and flags only genuinely dangerous patterns without attempting exploitation.

The Third Heap Overflow in Two Months: Is NGINX's Script Engine Fundamentally Broken?

CVE-2026-42533 does not exist in isolation. It is the third heap overflow disclosed in NGINX's expression-evaluation code in approximately two months. The first, nicknamed Rift and tracked as CVE-2026-42945, was disclosed in May. A second overlapping-captures bug in the rewrite module, CVE-2026-9256, followed days later. All three share the same architectural root cause: NGINX's two-pass script engine sizes a buffer in one pass and writes into it

Originally reported by RSS App New Cybersecurity Feed. Summarised and curated by European Purpose.