Heap-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2026-42533

Vulnerability identifier: #VU137847

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42533

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the map directive with regex matching when processing crafted HTTP requests that trigger regex capture variable references before the map output variable. A remote attacker can send crafted HTTP requests to execute arbitrary code or cause a denial of service.

Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. This is a data plane issue only.

NGINX Plus
NGINX Open Source
Gentoo Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx (Ubuntu package)
nginx-filesystem
nginx-help
nginx-debuginfo
nginx-all-modules
nginx-mod-stream
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx-debugsource
nginx
nginx-source
nginx-doc
nginx-core
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P7, 37.0.3.1
NGINX Open Source - addressed in versions 1.30.4, 1.31.3
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-11.fc45
nginx-mod-vts - update to 0.2.4-13.fc45
nginx-mod-fancyindex - update to 0.6.0-8.fc45
nginx-mod-headers-more - update to 0.40-3.fc45
nginx-mod-brotli - update to 1.0.0~rc-13.fc45
nginx-mod-modsecurity - update to 1.0.4-16.fc45
nginx-mod-naxsi - update to 1.6-21.fc45
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.17, 1.18.0-6ubuntu14.18, 1.18.0-6ubuntu14.19, 1.18.0-6ubuntu14.20, 1.24.0-2ubuntu7.14, 1.24.0-2ubuntu7.15, 1.24.0-2ubuntu7.16, 1.24.0-2ubuntu7.17, 1.28.3-2ubuntu1.7, 1.28.3-2ubuntu1.8, 1.28.3-2ubuntu1.9, 1.28.3-2ubuntu1.10
nginx-filesystem - update to 1.21.5-19
nginx-help - update to 1.21.5-19
nginx-debuginfo - update to 1.21.5-19
nginx-all-modules - update to 1.21.5-19
nginx-mod-stream - update to 1.21.5-19
nginx-mod-mail - update to 1.21.5-19
nginx-mod-http-xslt-filter - update to 1.21.5-19
nginx-mod-http-perl - update to 1.21.5-19
nginx-mod-http-image-filter - update to 1.21.5-19
nginx-mod-devel - update to 1.21.5-19
nginx-debugsource - update to 1.21.5-19
nginx - update to 1.21.5-19
nginx-source - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx-debugsource - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx-debuginfo - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.27.1
nginx-doc - update to 1.30.4-1
nginx-mod-devel - update to 1.30.4-1
nginx-filesystem - update to 1.30.4-1
nginx-all-modules - update to 1.30.4-1
nginx-mod-stream - update to 1.30.4-1
nginx-mod-mail - update to 1.30.4-1
nginx-mod-http-xslt-filter - update to 1.30.4-1
nginx-mod-http-perl - update to 1.30.4-1
nginx-mod-http-image-filter - update to 1.30.4-1
nginx - update to 1.30.4-1
nginx-core - update to 1.30.4-1
nginx - update to 1.30.4-1.fc45
www-servers/nginx - update to 1.31.3-r1

• https://my.f5.com/manage/s/article/K000162097

• Multiple vulnerabilities in NGINX Open Source
• Ubuntu update for nginx
• Ubuntu update for nginx
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• openEuler update for nginx
• SUSE update for nginx
• SUSE update for nginx
• Gentoo update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx