Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution - The Hacker News

What the report says

The Hacker News reported that F5 has released fixes for a critical NGINX vulnerability, tracked as CVE-2026-42533, that can let a remote unauthenticated attacker trigger a heap buffer overflow through specially crafted HTTP requests. According to the report, F5 patched the issue on July 15 in nginx 1.30.4 stable, nginx 1.31.3 mainline and NGINX Plus 37.0.3.1, and advised users of earlier versions to upgrade.

The flaw affects nginx’s request-time string evaluation logic and depends on a specific server configuration involving regex-based maps and capture variables. The Hacker News said exploitation can crash or restart nginx worker processes, creating a denial-of-service condition. F5 also warned that remote code execution may be possible in cases where address space layout randomization is disabled or can be bypassed. The vendor rated the bug 9.2 under CVSS v4 and 8.1 under CVSS v3.1, with high attack complexity.

The report said F5’s advisory also lists NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager as affected, though fixed builds for those products had not been listed at publication. The vulnerability reportedly affects nginx versions from 0.9.6 through 1.31.2, reflecting the long-standing nature of the relevant regex map functionality.

Researcher Stan Shaw, one of several people credited with reporting the issue, told The Hacker News he believes the bug may be more exploitable than F5’s advisory suggests, though he had not released proof-of-concept details. F5’s temporary mitigation is to use named captures in affected regex maps, but the article emphasized that upgrading is the complete fix. As of July 20, the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code had appeared.