CVE-2026-42533 NGINX Map directive and Regex matching vulnerability
Remote attackers can cause denial of service or potentially execute code via heap buffer overflow in NGINX when specific map directive configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42533?
CVE-2026-42533 is a critical memory corruption vulnerability in F5 NGINX Open Source, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-122
Which versions are affected by CVE-2026-42533?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 0.9.6 | 1.30.4, 1.31.3 |
nginx-gateway Bitnami | From 0.9.6 | 1.30.4, 1.31.3 |
Linux distribution packages (38)
nginx AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-all-modules AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-core AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-filesystem AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-devel AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-http-image-filter AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-http-perl AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-http-xslt-filter AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-mail AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx-mod-stream AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.7 |
nginx AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-all-modules AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-filesystem AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-devel AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-http-image-filter AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-http-perl AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-http-xslt-filter AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-mail AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx-mod-stream AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4275+5756017d.5.alma.1 |
nginx AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-all-modules AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-core AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-filesystem AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-mod-devel AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.6.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+309+b8a3c30d.4 |
nginx-mod-http-perl AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+307+7a7a3a71.5.alma.1 |
Products include F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus, F5 Waf.
How do I fix CVE-2026-42533?
Upgrade nginx to a fixed version for your release line: 1.30.4 or 1.31.3.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42533 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42533 exists.
Public exploit code: 12 proofs of concept on GitHub.
Other vulnerabilities in F5 NGINX Open Source
Sources
Also known as ALPINE-CVE-2026-42533, ALSA-2026:66542, ALSA-2026:67283, ALSA-2026:67308, ALSA-2026:67314, ALSA-2026:67315 and 47 more.