NGINX's Two-Pass Script Engine Just Broke Again: What CVE-2026-42533 Means for Your Edge

A single crafted GET request against a default Ubuntu 24.04 NGINX install can leak the exact heap addresses an attacker needs to turn a denial-of-service bug into remote code execution — and the vendor’s own advisory doesn’t quite say that out loud. That’s the uncomfortable gap between F5’s July 15 advisory for CVE-2026-42533 and the reporter’s own writeup, and it’s the reason security teams should treat this as more than a routine patch cycle.

F5 shipped fixes on July 15 in NGINX 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus 37.0.3.1. The flaw is a heap buffer overflow in the worker process, reachable by a remote, unauthenticated attacker with crafted HTTP requests. F5 scores it 9.2 on CVSS v4 and 8.1 on v3.1, and rates attack complexity high. Every version from 0.9.6 through 1.31.2 is affected — a 15-year window that opens in 2011, when map gained regex support.

Why The Two-Pass Script Engine Keeps Failing

The bug lives in NGINX’s script engine, the code that assembles strings from directives at request time. Under a specific pattern — a regex-based map whose output variable is referenced in a string expression after a numbered capture ($1, $2) from an earlier regex match — the engine’s two-pass evaluation falls apart. The first pass measures how many bytes the result needs; the second pass writes the bytes in. Evaluating the map’s regex between those passes overwrites the shared capture state, so the writing pass fills a buffer that was sized for a different value.

Why it matters: this is the third heap overflow disclosed in NGINX’s expression-evaluation code in roughly two months. Rift (CVE-2026-42945) landed in May, then an overlapping-captures bug in the rewrite module (CVE-2026-9256) days later, and now this one. All three exploit the same architectural weakness — a two-pass design that trusts its own measurement — with different triggers. When a class of bug keeps returning under different names, patching individual CVEs stops being a strategy.

If you’re running NGINX as an ingress controller in Kubernetes, upstream RCE risk propagates directly into your data plane. F5’s advisory lists NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager as affected — and at publication, fixed builds for those four downstream products hadn’t been named.

Our take: expect a fourth script-engine CVE in this same family before the end of the year. The pattern is too consistent to be coincidence.

When “May Allow RCE” Is Doing A Lot Of Work

F5 conditions code execution on ASLR being disabled or bypassable. Reporter Stan Shaw (who publishes as cyberstan) argues in his detailed writeup that the flaw supplies its own bypass. The capture-clobbering runs in reverse too: when the clobbered capture is smaller than the original, the oversized buffer hands back uninitialised heap data. On a default Ubuntu 24.04 build, Shaw says a single unauthenticated GET recovers the addresses a payload needs. He rated exploitability 10 out of 10 in his own testing.

Why it matters: “A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not,” Shaw told The Hacker News. If you’re prioritizing patch windows based on the vendor’s hedge language, you’re going to under-weight this one. The gap between “may allow RCE if ASLR is bypassed” and “the bug is the ASLR bypass” is the difference between a maintenance-window patch and an emergency change.

Practical scenario: if you’re running an NGINX edge in front of a healthcare application, the exposure isn’t just an outage — it’s a foothold into the layer that handles PHI before it ever reaches the app tier. Teams building regulated healthcare software should treat the ingress layer as in-scope for the same threat modeling they apply to the application itself.

Our take: expect a public proof-of-concept within days of Shaw’s promised 21-day disclosure. Rift went from patch to active exploitation in the wild in that same window.

The Config Pattern To Grep For Right Now

The good news: exposure depends on configuration, not just version. The pattern is narrow — a regex-based map whose variable appears in a string expression alongside a numbered capture ($1, $2) from an earlier regex, with the capture written ahead of the map variable. F5’s temporary mitigation is to switch affected regex maps to named captures, which Shaw says closes the main path.

But the mitigation isn’t complete. Shaw told The Hacker News that a map defining the same named group as the location regex reaches the same overflow through a second code path — confirmed with AddressSanitizer, and not mentioned in F5’s advisory. “Upgrading to 1.30.4 / 1.31.3 is the only complete fix,” he said.

Shaw published a config scanner on GitHub that follows includes and flags only the exploitable ordering. It doesn’t exploit anything, but as the reporter’s tool it isn’t a vendor product either — factor that into how you deploy it.

Practical scenario: if you run a multi-tenant reverse proxy fleet, the config-dependent nature of this bug means a fleet-wide vulnerability scan by version alone will over-report. Pipe your configs through the scanner, mark the actually-exploitable hosts, then use that list to justify emergency change windows to your CAB. If your team manages complex logistics platforms with dozens of tenant-specific NGINX configs, this triage is mandatory.

Our take: named-capture mitigation is going to be the tempting shortcut for teams that can’t schedule a restart. That shortcut leaves a variant path open. Just patch.

FAQ

Q: How do I know if my NGINX config is actually vulnerable to CVE-2026-42533? A: You need a regex-based map directive whose output variable is referenced in a string expression that also uses a numbered capture ($1, $2) from an earlier regex — with the capture appearing before the map variable in the string. Version alone doesn’t determine exposure; the config pattern does. Shaw’s open-source scanner automates the check across includes.

Q: Is switching to named captures a safe long-term fix? A: No. F5 lists named captures as a temporary mitigation, but Shaw documented a variant path where a map defining the same named group as the location regex triggers the same overflow. Upgrading to NGINX 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 is the only complete fix.

Q: Is this being actively exploited? A: As of July 20, CVE-2026-42533 is not on CISA’s Known Exploited Vulnerabilities catalog and no public exploit code has appeared. Shaw plans to publish his proof-of-concept 21 days after the patch. The related Rift vulnerability (CVE-2026-42945) saw active exploitation within days of public exploit release, so the window to patch ahead of weaponization is short.

Key Takeaways

• Patch to NGINX 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 now — the named-capture mitigation has a documented variant bypass and should not be treated as a permanent fix.
• Don’t trust CVSS or vendor hedge language alone. F5 calls RCE conditional on ASLR bypass; the reporter demonstrated the bug provides the bypass itself on stock Ubuntu 24.04.
• Three script-engine overflows in two months means teams should assume a fourth is coming. Consider architectural mitigations — WAF rules that block anomalous regex-triggering paths, or moving critical services behind a second proxy layer of a different vendor.
• Downstream F5 products (NGINX Ingress Controller, Gateway Fabric, App Protect WAF, Instance Manager) were listed as affected without fixed builds at publication. Track those advisories separately and don’t assume core patches propagate automatically.
• Kubernetes ingress operators should treat this as data-plane RCE risk, not just an edge-proxy issue. Audit whether your ingress controller version tracks upstream NGINX releases within days or weeks — that lag is your real exposure window.