CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released
Do Son 
TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researchers say it even carries its own ASLR bypass, which raises the odds of remote code execution. F5 patched it on July 15, 2026.
- CVE: CVE-2026-42533
- CVSS: 9.2 (Critical · CVSSv4)
- Product: F5 NGINX Plus
- Affected: 37.0.0.1, R36, R33, 1.31.2, 0.9.6
- Impact: NGINX Map directive and Regex matching vulnerability
- Status: No confirmed exploitation yet
- Patched in: 37.0.3.1, R36 P7, 1.31.3, 1.30.4
- EPSS: 3.6% (30-day)
- Action: Update to 37.0.3.1, R36 P7, 1.31.3, 1.30.4 now
Why This NGINX Heap Overflow Matters
The flaw needs no login and no user interaction. It fires in the data plane, before TLS termination. Therefore, an attacker can reach it directly from the internet.
A crash restarts the worker and causes denial of service. Worse, the bug also leaks heap memory. That leak can defeat ASLR, so code execution becomes realistic rather than theoretical.
Security researcher Zhenpeng (Leo) Lin called it a powerful NGINX bug that pairs an info leak with an out-of-bounds heap write. He shared that assessment on X.
How the Attack Works
NGINX builds strings in two passes. The first pass measures the output length. The second pass copies the data.
A regex-based map can change the shared capture state between those two passes. As a result, the copy pass writes more bytes than the measure pass reserved. That mismatch overflows the heap buffer in the worker.
The trigger sits in the Stream module. An attacker sends a TLS ClientHello with a long SNI to a listener that uses ssl_preread and a vulnerable map-and-capture pattern.
Public Disclosure and Exploit Status
Both the vulnerability details and a crash proof-of-concept are now public. The public technical report reproduces the overflow against an ASAN build. For the vendor view, read F5’s security advisory.
Researchers are withholding the full weaponized exploit for now. So far, no in-the-wild exploitation has been confirmed.
Affected Versions
NGINX Open Source 1.30.0 through 1.30.3 and mainline 1.31.2 are vulnerable. NGINX Plus 37.0.0.1 through 37.0.2.1 is also affected. Several F5 products inherit the bundled code:
- NGINX Open Source — fixed in 1.30.4 (stable) and 1.31.3 (mainline)
- NGINX Plus — fixed in 37.0.3.1 or R36 P7
- NGINX Instance Manager 2.17.0–2.22.1 — fixed in 2.22.2
- F5 WAF for NGINX 5.9.0–5.13.3 — fixed in 5.13.4
- NGINX Gateway Fabric 2.0.0–2.6.6 — fixed in 2.6.7
- NGINX Ingress Controller 5.0.0–5.5.2 — fixed in 5.5.3
Patch and Mitigation Steps
Upgrade to a fixed NGINX build right away. If you cannot patch, switch numbered regex captures to named captures in affected map blocks. That change reduces exposure, but only an upgrade fully closes the NGINX heap overflow.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
