NGINX patches 15-year heap overflow | CVE-2026-42533 spans 0.9.6 to 1.31.2, CVSS 9.2
TL;DR
F5 patches CVE-2026-42533 in NGINX, CVSS 9.2. A two-pass evaluation bug in the script engine lets unauthenticated remote requests trigger heap overflow, DoS or RCE. Affects every version from 0.9.6 (2011) through 1.31.2.
F5 has issued an emergency update for NGINX to patch CVE-2026-42533 (CVSS 9.2). The flaw sits in the script engine's two-pass evaluation: when a regex-based
Affected versions span from 0.9.6 (released 2011) all the way through 1.31.2 — a 15-year window. Mufeed VH of Winfunc Research and maintainer Maxim Dounin coordinated the disclosure, with detailed analysis from Stan Shaw. Switching regex patterns to named captures lowers risk; the only true fix is to upgrade.
Fixed versions: stable 1.30.4, mainline 1.31.3, and NGINX Plus 37.0.3.1. Upgrade immediately — no workaround is comparable.
via The Hacker News
map output variable appears in a string expression alongside a numbered capture from an earlier regex match, the measuring pass and the writing pass read different capture states, undersizing the buffer and triggering a heap overflow. An unauthenticated remote attacker sending a crafted HTTP request can crash worker processes for DoS, or achieve RCE under specific configurations.Affected versions span from 0.9.6 (released 2011) all the way through 1.31.2 — a 15-year window. Mufeed VH of Winfunc Research and maintainer Maxim Dounin coordinated the disclosure, with detailed analysis from Stan Shaw. Switching regex patterns to named captures lowers risk; the only true fix is to upgrade.
Fixed versions: stable 1.30.4, mainline 1.31.3, and NGINX Plus 37.0.3.1. Upgrade immediately — no workaround is comparable.
via The Hacker News
