NGINX Heap-Based Buffer Overflow

Byadmblake

What is the Vulnerability? FortiGuard Labs is tracking an exploitation risk associated with CVE-2026-42533, a heap-based buffer overflow vulnerability affecting NGINX Open Source and NGINX Plus. The flaw occurs when the map directive uses regex matching and capture variables in a specific configuration pattern. An unauthenticated remote attacker can send crafted HTTP requests that may…

What is the Vulnerability?

FortiGuard Labs is tracking an exploitation risk associated with CVE-2026-42533, a heap-based buffer overflow vulnerability affecting NGINX Open Source and NGINX Plus. The flaw occurs when the map directive uses regex matching and capture variables in a specific configuration pattern. An unauthenticated remote attacker can send crafted HTTP requests that may crash the NGINX worker process, resulting in denial of service, and potentially achieve remote code execution when ASLR is disabled or bypassed.

The vulnerability was publicly disclosed by F5 on July 15, 2026, with NGINX releasing fixed versions the same day.

Fortinet has conducted an internal security review of products and services that use NGINX. Based on the current assessment, Fortinet products are not affected by CVE-2026-42533.

What is the Recommended Mitigation?

Affected products:

NGINX Open Source 0.9.6–1.30.3 and 1.31.0–1.31.2

NGINX Plus R33–R36

NGINX Plus R37 37.0.0.1–37.0.2.1

NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF, and other F5/NGINX products with affected bundled versions.

Organizations should:

• Upgrade NGINX Open Source to 1.30.4 or 1.31.3 or later, depending on the deployment branch.

• Upgrade NGINX Plus to a fixed release, including R36 P7 or 37.0.3.1 where applicable.

• Review NGINX configurations for map directives using regex captures and confirm whether vulnerable variable-reference patterns are present.

• Prioritize Internet-facing NGINX deployments and reverse proxies.

• Deploy WAF protections to detect and block malicious HTTP requests targeting vulnerable NGINX configurations while patching is underway.

• Monitor NGINX worker-process crashes, abnormal HTTP requests, and other indicators of attempted exploitation.

What FortiGuard Coverage is available?

• FortiGuard IPS Service: Detects and blocks network-based attacks targeting vulnerable NGINX assets.

Intrusion Prevention | FortiGuard Labs


• FortiWeb: Provides mitigation for CVE-2026-42533 through a custom signature and HTTP protocol constraint to help protect vulnerable NGINX deployments while patching is underway.

Technical Tip: Defending against 2026-42533 with FortiWeb | Community


• FortiGuard Vulnerability Management: Identifies vulnerable NGINX assets and helps prioritize remediation based on exposure and risk.

• FortiGuard Incident Response Service: FortiGuard Incident Response Service assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.

Related