CVE-2026-42533

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.

Security Fix(es):

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42533)

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.

Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-56434)

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-60005)

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• SECURITY UPDATE: heap buffer overflow and info-leak via regex map capture variables
  • debian/patches/CVE-2026-42533.patch: add script engine buffer-overrun protection
  • CVE-2026-42533

• CVE-2026-42533: script engine capture-state save/restore + heap buffer overrun protection

• SECURITY UPDATE: heap buffer overflow in nginx worker via map+regex capture variables in script engine
  • debian/patches/CVE-2026-42533.patch: backport upstream commits ea47fabf55e2 (Script: simplified copy capture codes), 7ac67898bdfe (Script: buffer overrun protection), 326b17b00383 (Script: buffer overrun protection in direct script usage), 78950bdcd443 (Access log: buffer overrun protection), b99f804ad38a (Fixed uninitialized memory read caused by stale regex captures), and 97e40e59b7b4 (Script: avoid garbage at the end of the result string); add e->end pointer and ngx_http_script_check_length() guard to all script copy code paths, reset r->ncaptures on regex reallocation, and thread params_len / headers_len through fastcgi, grpc, scgi, uwsgi upstream request builders so an attacker-controlled map+regex expansion can no longer overrun the assembled request or access log buffer
  • CVE-2026-42533

• SECURITY UPDATE: heap buffer overflow and info-leak via regex map capture variables
  • debian/patches/CVE-2026-42533.patch: add script engine buffer-overrun protection
  • CVE-2026-42533

• CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables

• CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables

• CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables

• CVE-2026-42533: add script-engine buffer overrun protection to fix heap buffer overflow when a map regex capture (or a non-cacheable variable) is used in a string expression

• CVE-2026-42533: add script-engine buffer overrun protection to fix heap buffer overflow when a map regex capture (or a non-cacheable variable) is used in a string expression

• CVE-2026-42533: fix heap buffer overflow in the map directive with regex matching (script engine buffer overrun protection)

• CVE-2026-42533: fix heap buffer overflow in the map directive with regex matching (script engine buffer overrun protection)

• CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables

• CVE-2026-42533: add script-engine buffer overrun protection to fix heap buffer overflow when a map regex capture (or a non-cacheable variable) is used in a string expression

• SECURITY UPDATE: heap buffer overflow in the script engine when a map regex capture or a non-cacheable variable changes length between the length and copy passes of a string expression
  • debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the access logs and the direct script users in the proxy, fastcgi, scgi, uwsgi, grpc, index and try_files modules, and cut the result to its actual length
  • debian/modules/patches/http-ndk/CVE-2026-42533-ndk.patch: emit the new complex value end code in the bundled NDK, which keeps its own copy of the rewrite value compiler
  • debian/modules/patches/nchan/CVE-2026-42533-nchan.patch: bounds check the script copy codes run by the bundled nchan module
  • CVE-2026-42533
• IMPORTANT: the layout of the script engine structures changed (an end pointer was added to ngx_http_script_engine_t and ngx_stream_script_engine_t, and a status field to the stream one), and complex values compiled for the rewrite engine now need the new ngx_http_script_complex_value_end_code. Third-party dynamic modules that drive the nginx script engine directly must be rebuilt against this version and updated, otherwise they cause memory corruption and worker crashes. This affects NDK based modules such as set-misc, array-var, encrypted-session, form-input and the set_by_lua directive of the lua module. The bundled NDK has been adapted.

CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression. Thanks to Mufeed VH of Winfunc Research and Maxim Dounin. . CVE-2026-60005: Uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination. . CVE-2026-56434: Use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module. Thanks to P4P3R-HAK.

These are all security issues fixed in the nginx-1.31.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nginx fixes the following issue

• CVE-2026-42533: map directive and regex matching vulnerability (bsc#1271514).

Root has patched CVE-2026-42533 in the nginx package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-42533 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-42533 in the nginx package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-42533 in the nginx package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-42533 in the nginx package for Root:Debian:13. Multiple fixed versions available.

This update for nginx fixes the following issue

• CVE-2026-42533: map directive and regex matching vulnerability (bsc#1271514).

This update for nginx fixes the following issue

• CVE-2026-42533: map directive and regex matching vulnerability (bsc#1271514).

This update for nginx fixes the following issues:

• CVE-2026-42055: heap buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492).
• CVE-2026-42533: heap buffer overflow in the map directive and regex matching (bsc#1271514).
• CVE-2026-48142: heap buffer overread in the ngx_http_charset_module module (bsc#1268495).
• Remote denial of service via the HTTP/2 bomb exploit (bsc#1267525).