F5 and the nginx project shipped fixes on July 15 for CVE-2026-42533, a buffer overflow in nginx’s script engine that can crash worker processes and, under specific conditions, may allow remote code execution. The flaw affects nginx Open Source versions 0.9.6 through 1.31.2, and is fixed in 1.31.3 and 1.30.4, according to the official nginx security advisory.
The bug lives in the code that assembles strings from configuration directives at request time. It only surfaces in a specific configuration pattern: a regex based map directive whose output variable is referenced in a string expression after a capture from an earlier regex match. An unauthenticated attacker who can reach an affected server can trigger the overflow with a crafted request, crashing the worker process. Where address space layout randomization is disabled or can be bypassed, security researchers tracking the disclosure say the same flaw may also permit code execution, not just denial of service.
This is the kind of vulnerability that gets deprioritized in a crowded patch queue because it needs a specific configuration to trigger, and CyberTech has already covered why that instinct is increasingly risky: as CyberTech reported, security teams are being forced to trade patching everything for triaging what is actually exploitable, and a web server flaw with a plausible RCE path in a widely deployed reverse proxy is exactly the kind of finding that triage should surface, not bury. Any team running nginx Open Source, nginx Plus, NGINX Ingress Controller, or NGINX Gateway Fabric should check whether their configuration uses map directives with regex captures referenced in later string expressions, and patch or mitigate regardless of whether that pattern is present, since configuration drift is common and audit coverage is not guaranteed.
Source: nginx
