CVE-2026-42533
CRITICAL 9.2 ALL-YEARSA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severe if exploited (CVSS 9.2), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.9%chance of exploitation in 30 days · 59th percentile
Impact if exploited
9.2CVSS 4.0 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Affected
Vendors F5
Products Nginx Plus Nginx Open Source Nginx Gateway Fabric Nginx Ingress Controller Waf
Weakness (CWE)
- CWE-122: Heap-based Buffer Overflow
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 419 vendor product statements; 387 omitted. Read the full vendor advisory.
nginx-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debuginfo-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-image-filter-debuginfo-2:1.26.3-6.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-2:1.26.3-6.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24848%2B0300f002.5?arch=x86_64&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24848%2B0300f002.5?arch=aarch64&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-xslt-filter-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24848%2B0300f002.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24848%2B0300f002.5?arch=ppc64le&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-core-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24846%2Be7eec568.5?arch=x86_64&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-core-debuginfo-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24845%2Ba897661e.4?arch=aarch64&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debugsource-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24845%2Ba897661e.4?arch=s390x&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-image-filter-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24846%2Be7eec568.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-perl-2:1.20.1-28.el9_8.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=x86_64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-perl-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24845%2Ba897661e.4?arch=ppc64le&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24845%2Ba897661e.4?arch=x86_64&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-mail-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24846%2Be7eec568.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-mail-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24845%2Ba897661e.4?arch=ppc64le&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debugsource-2:1.26.3-6.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=x86_64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.7?arch=ppc64le&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=s390x&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.6?arch=aarch64&epoch=2
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-devel-0:1.30.4-2.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
nginx-mod-stream-geoip-0:1.30.4-2.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
insights-proxy/insights-proxy-container-rhel9 as a component of Red Hat Lightspeed proxy 1 · known affected
Vendor assessment for this product only.
pkg:oci/insights-proxy-container-rhel9?repository_url=registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available.
- none available: Affected
php.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
12 candidates
- https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner
Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-10-22T00:55:09Z - https://github.com/srkyn/nginx-map-risk-audit
Defensive NGINX CVE-2026-42533 map regex risk audit with config scanner, Splunk/Defender notes, and lab evidence.
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-07-20T01:45:05Z - https://github.com/Daniyal48/ghostlock-vagrant-box
An isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed by root privilege escalation using the Ghostlock kernel vulnerability (CVE-2026-43449).
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-08-05T12:47:31Z - https://github.com/suominen/CVE-2026-42533
Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-10-12T07:19:27Z - https://github.com/seguridadentrerios/CVE-2026-42533
Vulnerabilidad en NGINX
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-07-23T06:07:56Z - https://github.com/gagaltotal/CVE-2026-42533-nginx
CVE-2026-42533 Nginx
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-07-23T10:25:20Z - https://github.com/jelasin/CVE-2026-42533PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-07-29T11:51:08Z - https://github.com/imbas007/CVE-2026-42533
nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-08-26T13:19:17Z - https://github.com/0xCyberstan/CVE-2026-42533-POC
CVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-08-17T08:41:26Z - https://github.com/Leeyoonjoo/CVE-2026-42533PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-08-17T10:30:32Z - https://github.com/FranklinF25/cve-2026-42533
CVE-2026-42533 — NGINX pre-auth heap overflow: analysis, safe detector, in-lab RCE
PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-10-22T00:41:45Z - https://github.com/ivanesk315/CVE-2026-42533PoC-in-GitHub · CVE-2026-42533
PoC-in-GitHub · CVE-2026-42533 · Updated 2026-09-10T07:14:54Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| F5 | Nginx Gateway Fabric | ≥ 1.3.0 and ≤ 1.6.2 |
| F5 | Nginx Gateway Fabric | ≥ 2.0.0 and < 2.6.7 |
| F5 | Nginx Ingress Controller | ≥ 3.5.0 and ≤ 3.7.2 |
| F5 | Nginx Ingress Controller | ≥ 5.0.0 and < 5.5.3 |
| F5 | Nginx Ingress Controller | ≥ 2026-lts-r1 and < 2026-lts-r4 |
| F5 | Nginx Ingress Controller | 4.0.0 |
| F5 | Nginx Ingress Controller | 4.0.1 |
| F5 | Nginx Plus | ≥ 37.0.0.1 and < 37.0.3.1 |
| F5 | Nginx Plus | ≥ r33 and < r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Nginx Plus | r36 |
| F5 | Waf | ≥ 4.11.0 and ≤ 4.16.0 |
| F5 | Waf | ≥ 5.2.0 and ≤ 5.8.0 |
| F5 | Waf | ≥ 5.9.0 and < 5.13.4 |
All CVSS metrics
- HIGH 8.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.2 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CRITICAL 9.2 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Patches & mitigations
- https://my.f5.com/manage/s/article/K000162097 CVE record · f5 · Updated 2026-07-15T21:20:26.156Z
NVD · CVE-2026-42533 · Updated 2026-08-10T15:28:01.940
Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44683 EUVD · EUVD-2026-44683
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-42533 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2500967 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-42533 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-42533 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:67314 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:67315 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:66542 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:67308 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:67283 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:46012 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
- https://access.redhat.com/errata/RHSA-2026:79357 Red Hat · CVE-2026-42533 · Updated 2026-10-09T00:47:44+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS