- F5 patched a critical nginx heap buffer overflow (CVE-2026-42533) rated 9.2 on CVSS v4, affecting versions since 2011.
- The flaw allows remote code execution if ASLR is disabled or bypassed; one researcher claims the bug itself provides the bypass.
- Upgrade to nginx 1.30.4 or 1.31.3 is the only complete fix; a partial mitigation leaves a narrower attack path open.
F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 and 1.31.3, as well as NGINX Plus 37.0.3.1.
Triggering the flaw can crash or restart the worker, causing denial of service; where ASLR is disabled or can be bypassed, F5 says it may also allow remote code execution. The overflow lives in nginx’s script engine, surfacing only under a specific configuration: a regex-based map whose output variable is referenced in a string expression after a capture from an earlier regex match.
Under that pattern the engine’s two-pass evaluation comes apart, as the first pass sizes a buffer for the original capture while the writing pass fills it from a different, attacker-sized one. Stan Shaw, who publishes as cyberstan, published a detailed writeup arguing the flaw supplies the ASLR bypass itself, telling The Hacker News that a single unauthenticated GET on a default Ubuntu 24.04 build recovers needed addresses.
“A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not,” Shaw said. The fix is to upgrade, but F5’s temporary mitigation of switching to named captures leaves a narrower path open, according to Shaw’s analysis.
This is the third heap overflow in nginx’s expression-evaluation code disclosed in about two months, following Rift and a rewrite-module bug. As of July 20, no public exploit code had appeared, but Shaw plans to publish his proof-of-concept 21 days after the patch.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
