nginx / NGINX Plus PCRE capture-clobber pre-auth heap overflow (CVSS 9.2); F5 out-of-band patch 2026-07-15/16, credited researcher demonstrates RCE beyond F5's DoS-only framing (no public PoC, no ITW as of 2026-07-20); fixed nginx 1.30.4/1.31.3, NGINX Plus R36 P7/37.0.3.1

CVE-2026-42533, nginx / NGINX Plus: PCRE capture-clobber pre-auth heap overflow, researcher demonstrates RCE beyond F5's DoS-only framing (CVSS 9.2)

CVE-2026-42533 is a missing save/restore of PCRE capture state across nginx's two-pass script-expression engine. nginx evaluates a compiled expression in a LEN pass that measures the result size and a VALUE pass that writes into a buffer sized by the LEN pass, and both passes resolve capture references such as $1 by reading r->captures, a shared mutable array on the request (Stan Shaw, 2026-07-19). When a map directive using a regex pattern is evaluated between the two passes, i.e. a config where a regex capture source (location, server_name, rewrite, or if) produces captures that appear before a regex map variable in the same evaluated buffer; the map's own regex evaluation clobbers the shared capture state, so the LEN and VALUE passes disagree on the buffer size. The result is an unauthenticated, pre-auth heap buffer overflow triggerable by crafted HTTP requests, reachable from any directive that evaluates a compiled expression (proxy_set_header, fastcgi_param, return, add_header, rewrite, set, root, alias, access_log, and more). The clobber is not specific to one call site: the same LEN/VALUE pattern appears in at least 13 independent call sites across 9 source files (Stan Shaw, 2026-07-19).

The bug has existed since nginx 0.9.6 (2011, when map gained regex support). F5 (which owns nginx) shipped an out-of-band fix on 2026-07-15/16 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus R36 P7 and release 37.0.3.1, rating it CVSS 4.0 9.2 (critical) / CVSS 3.1 8.1 (high) (SecurityWeek, 2026-07-16). F5's advisory frames real-world risk on ASLR-enabled systems as primarily denial-of-service, a characterization the credited discoverer directly disputes (Stan Shaw, 2026-07-19; The Hacker News, 2026-07-19). The credited discoverer, Stan Shaw, disputes the DoS-only framing and demonstrates two chainable primitives: an information-leak variant (a clobbered capture smaller than the original) that returns uninitialised heap residue (on Ubuntu 24.04 with glibc 2.39 a libc pointer at offset 0x08 and a heap pointer at 0x10, enough to defeat ASLR in one unauthenticated GET) and a heap-overflow variant (a clobbered capture larger than the original) that writes attacker-controlled request-body content past the buffer and hijacks control flow through nginx's pool-cleanup mechanism, which the original post reported at 10/10 reliability with full ASLR enabled (Stan Shaw, 2026-07-19). The revised write-up refines that figure, as the update of 2026-09-29 below records. "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw told The Hacker News (2026-07-19).

The author held back the proof of concept and the full write-up for about three weeks after the patch and has since published both (see the update below); no in-the-wild exploitation has been reported and the CVE is not in CISA KEV. The precedent the author cites is directly relevant: CVE-2026-42945 ("Rift"), a weaker flaw in the same nginx script engine that only mattered with ASLR disabled, "saw active exploitation shortly after its PoC dropped" (Stan Shaw, 2026-07-19; Rift's confirmed in-the-wild exploitation was covered here on 2026-05-18). This bug does not require ASLR to be off, so the same trajectory should be assumed now that the PoC is public.