Heap-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2026-42533

Vulnerability identifier: #VU137847

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42533

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the map directive with regex matching when processing crafted HTTP requests that trigger regex capture variable references before the map output variable. A remote attacker can send crafted HTTP requests to execute arbitrary code or cause a denial of service.

Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. This is a data plane issue only.

NGINX Plus
NGINX Open Source
Debian Linux
Gentoo Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx (Ubuntu package)
nginx (Red Hat package)
nginx-mod-devel
nginx-help
nginx-filesystem
nginx-all-modules
nginx-mod-stream
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-debugsource
nginx-debuginfo
nginx
nginx-source
nginx (Debian package)
nginx-core
nginx-doc
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P7, 37.0.3.1
NGINX Open Source - addressed in versions 1.30.4, 1.31.3
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-11.fc45
nginx-mod-vts - update to 0.2.4-13.fc45
nginx-mod-fancyindex - update to 0.6.0-8.fc45
nginx-mod-headers-more - update to 0.40-3.fc45
nginx-mod-brotli - update to 1.0.0~rc-13.fc45
nginx-mod-modsecurity - update to 1.0.4-16.fc45
nginx-mod-naxsi - update to 1.6-21.fc45
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.17, 1.18.0-6ubuntu14.18, 1.18.0-6ubuntu14.19, 1.18.0-6ubuntu14.20, 1.18.0-6ubuntu14.21, 1.24.0-2ubuntu7.14, 1.24.0-2ubuntu7.15, 1.24.0-2ubuntu7.16, 1.24.0-2ubuntu7.17, 1.24.0-2ubuntu7.18, 1.28.3-2ubuntu1.7, 1.28.3-2ubuntu1.8, 1.28.3-2ubuntu1.9, 1.28.3-2ubuntu1.10, 1.28.3-2ubuntu1.11
nginx (Red Hat package) - update to 1.20.1-28.el9_8.6
nginx-mod-devel - update to 1.21.5-19
nginx-help - update to 1.21.5-19
nginx-filesystem - update to 1.21.5-19
nginx-all-modules - update to 1.21.5-19
nginx-mod-stream - update to 1.21.5-19
nginx-mod-mail - update to 1.21.5-19
nginx-mod-http-xslt-filter - update to 1.21.5-19
nginx-mod-http-perl - update to 1.21.5-19
nginx-mod-http-image-filter - update to 1.21.5-19
nginx-debugsource - update to 1.21.5-19
nginx-debuginfo - update to 1.21.5-19
nginx - update to 1.21.5-19
nginx-source - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx-debugsource - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx-debuginfo - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx (Debian package) - update to 1.26.3-3+deb13u8
nginx-core - update to 1.30.4-1
nginx-filesystem - update to 1.30.4-1
nginx-doc - update to 1.30.4-1
nginx-all-modules - update to 1.30.4-1
nginx-mod-stream - update to 1.30.4-1
nginx-mod-mail - update to 1.30.4-1
nginx-mod-http-xslt-filter - update to 1.30.4-1
nginx-mod-http-perl - update to 1.30.4-1
nginx-mod-http-image-filter - update to 1.30.4-1
nginx - update to 1.30.4-1
nginx-mod-devel - update to 1.30.4-1
nginx - update to 1.30.4-1.fc45
www-servers/nginx - update to 1.31.3-r1

• https://my.f5.com/manage/s/article/K000162097

• Multiple vulnerabilities in NGINX Open Source
• Ubuntu update for nginx
• Ubuntu update for nginx
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• openEuler update for nginx
• SUSE update for nginx
• SUSE update for nginx
• Gentoo update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• Red Hat Enterprise Linux 9 update for nginx
• Debian update for nginx
• Red Hat Enterprise Linux 9 update for the nginx:1.26 module
• Red Hat Enterprise Linux 9 update for the nginx:1.24 module
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Ubuntu update for nginx