Critical alert: nginx under attack by heap overflow through maps based on regular expressions and two past; updates already

F5 and the nginx team have published corrections for critical vulnerability (CVE-2026-42533) that allows a remote and unauthenticated attacker to cause heap overflow in the worker processes by specially built HTTP requests. The failure lies in the nginx scripts engine, which converts directives into chains in demand time using a two-pass evaluation that can be measured and then written into a poorly dimensioned buffer, and updates are available in nginx 1.30.4 (stable), 1.31.3 (mainline) and NGINX Plus 37.0.3.1; any previous version is potentially vulnerable.

Vulnerability is not universal: it appears only under a specific configuration. A map based on regular expressions is needed whose output value is used in a chain expression just after a numbered capture (e.g. $1) of a previous match. In this pattern the first pass calculates how many bytes are needed and reserves a buffer, but if another regex (that of the map) is reevaluated between means that overwrites the status of the catches, the second last copy longer or different data in a buffer too small. The overflow and its bytes come directly from the request, so it can cause from a restart of the worker (DoS) to, under conditions where ASLR is absent or can be mocked, remote code execution.

F5 places the impact at 9.2 on the CVSS v4 scale (8.1 on the v3.1) and warns that the complexity of the attack is high, but the researchers who reported the failure have shown that in real scenarios vulnerability can facilitate techniques to recover directions from the heap and turn a crack into a more reliable explosion. The range of affected versions covers nginx from 0.9.6 to 1.31.2, a print that goes back until 2011, when map won regex support.

In addition to the central server and NGINX Plus, F5 indicates that downstream components such as NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager are affected, although at the end of the note no corrected building for these variants had yet been published. This leaves the need for monitoring official communications from their suppliers and planning temporary mitigation or coordinated deployment to management.

The final correction is the update to the published versions: nginx 1.36.4 or 1.31.3, and NGINX Plus 37.0.3.1. If you can't park right away, F5 proposes as temporary mitigation to change regex maps to use name capture, a measure that closes the main track described in the notice. However, one of the researchers who contributed to the finding has warned that such mitigation may not be complete: it detected a variant that still reaches an overflow by a second code route, so the only complete correction is to apply the official update.

In practice, the recommended response for infrastructure and security equipment is double: first, to make urgent inventory of configurations to find regex-based maps whose variables refer to expressions along with numbered catches and, second, to plan and implement the updating of packages of the nginx server and any focused product that depends on it. Search your configuration files for patterns using "map" with regular expressions and type $1 / $2 variables; if you confirm the vulnerable combination, prioritize the immediate mitigation or patch.

It is also appropriate to prepare for the explosion publication window: the researcher who expanded the report announced that he will publish a proof-of-concept 21 days after the patch, and recent experience with another similar failure (Rift) showed that public exploits can appear and move soon to active exploitation. Therefore, in addition to patching or mitigating, it monitors access records and errors in search of abnormal requests to endpoints that can activate maps or rewrites, and applies network detection to identify mass survey patterns.

To follow sources and get official releases, check the nginx change notes and your provider's security notice channels. The nginx change page for the affected versions appears in your official notes, for example nginx 1.30.4 and nginx 1.31.3. It is also prudent to review the American government's catalogue of known vulnerabilities to see if the failure falls into a priority list: CISA Known Exploited Vulnerabilities.

In short, this vulnerability exemplifies a recurrent pattern in nginx: a two-pass evaluation engine that trusts its own measurement can fail if the shared state is altered between the past. The most secure and responsible action is to update as soon as possible; mitigation is used to gain time, not to replace the patch.. If you manage critical environments, prioritize the detection in configurations, coordinate patches throughout the supply chain (including Ingress and WAFs drivers) and maintain enhanced surveillance until the corrected versions are deployed in production.