---
schema: 1
kind: vulnerability
title: "CVE-2026-42533 — nginx / NGINX Plus: PCRE capture-clobber pre-auth heap overflow, researcher demonstrates RCE beyond F5's DoS-only framing (CVSS 9.2)"
headline: "F5 out-of-band patches a 15-year-old pre-auth heap overflow in nginx's script engine; credited researcher shows it reaches RCE"
summary: >
  F5 shipped an out-of-band fix (nginx 1.30.4 / 1.31.3, NGINX Plus R36 P7 / 37.0.3.1)
  for CVE-2026-42533, a pre-auth heap buffer overflow reachable via crafted HTTP requests
  on any nginx config that references a regex `map` variable after a regex capture in the
  same evaluated string. F5 frames real-world risk as primarily denial-of-service; the
  credited discoverer disputes that and demonstrates a reliable pre-auth RCE that defeats
  ASLR in a single request. No public exploit PoC yet (withheld ~21 days) and no
  in-the-wild exploitation, but the bug affects nginx 0.9.6 (2011) onward — anyone running
  internet-facing nginx/NGINX Plus should treat the F5 OOB patch as out-of-cycle.
discovered_at: "2026-07-20T04:27:00Z"
event_date: "2026-07-15"
run_id: 2026-07-20T0409Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [technology, public-sector, energy, finance, telco]
entities: []
techniques: [T1190]
affected_products: ["F5 NGINX Open Source", "F5 NGINX Plus"]
cves:
  - id: CVE-2026-42533
    cvss: "9.2"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "nginx OSS 0.9.6–1.30.3 (stable) / 1.31.2 (mainline); NGINX Plus R33–R36 and 37.0.0.1–37.0.2.1"
    fixed: "nginx 1.30.4 (stable) / 1.31.3 (mainline); NGINX Plus R36 P7 / 37.0.3.1"
sources:
  - url: "https://cyberstan.co.uk/nginx-rce/"
    publisher: "Stan Shaw (cyberstan.co.uk)"
    date: "2026-07-19"
    role: primary
  - url: "https://www.securityweek.com/f5-patches-multiple-nginx-big-ip-vulnerabilities/"
    publisher: "SecurityWeek"
    date: "2026-07-16"
    role: corroborating
  - url: "https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html"
    publisher: "The Hacker News"
    date: "2026-07-19"
    role: corroborating
closed_sources: []
evidence:
  - quote: "A missing save/restore of PCRE capture state in nginx’s script engine lets a remote unauthenticated attacker trigger a heap buffer overflow with fully controlled content and length"
    publisher: "Stan Shaw (cyberstan.co.uk)"
  - quote: "This bug does not require ASLR to be off. The info leak primitive defeats it in a single GET request."
    publisher: "Stan Shaw (cyberstan.co.uk)"
verification: multi-source
sourcing_note: "Vuln existence, affected/fixed versions and CVSS are F5's (F5 SIRT advisory K000162097, confirmed via SecurityWeek and F5's own CVE record — CVSS 4.0 9.2 / CVSS 3.1 8.1; F5's advisory page is JS-gated and not directly citable). The load-bearing claim that the bug reaches full pre-auth RCE (not DoS-only) is the credited discoverer's own demonstration, single-origin and not independently reproduced; F5's CVE text itself allows code execution 'when the attacker can bypass ASLR'. No exploit PoC is public yet (author withholding ~21 days post-patch); a non-exploitative config-audit scanner is public."
confidence: high
update_of: null
references: []
deep_dive: true
deep_dive_category: network-stack-rce
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every internet-facing nginx to ≥ 1.30.4 (stable) or 1.31.3 (mainline), and NGINX Plus to R36 P7 / 37.0.3.1 — F5 released this out-of-band, so it is not carried by a normal release-train upgrade."
  - "Before patching, audit each internet-facing nginx config for a regex `map` variable referenced after a regex capture ($1/$2/named groups from location/server_name/rewrite/if) in the same evaluated string; restructure (move the map reference before the capture, or split the expression) to remove the trigger on any host that cannot be patched immediately."
migrated_from: null
---

CVE-2026-42533 is a missing save/restore of PCRE capture state across nginx's two-pass script-expression engine. nginx evaluates a compiled expression in a LEN pass that measures the result size and a VALUE pass that writes into a buffer sized by the LEN pass, and both passes resolve capture references such as `$1` by reading `r->captures`, a shared mutable array on the request ([Stan Shaw, 2026-07-19](https://cyberstan.co.uk/nginx-rce/)). When a `map` directive using a regex pattern is evaluated between the two passes — i.e. a config where a regex capture source (`location`, `server_name`, `rewrite`, or `if`) produces captures that appear *before* a regex `map` variable in the same evaluated buffer — the map's own regex evaluation clobbers the shared capture state, so the LEN and VALUE passes disagree on the buffer size. The result is an unauthenticated, pre-auth heap buffer overflow triggerable by crafted HTTP requests, reachable from any directive that evaluates a compiled expression (`proxy_set_header`, `fastcgi_param`, `return`, `add_header`, `rewrite`, `set`, `root`, `alias`, `access_log`, and more). The clobber is not specific to one call site: the same LEN/VALUE pattern appears in at least 13 independent call sites across 9 source files ([Stan Shaw, 2026-07-19](https://cyberstan.co.uk/nginx-rce/)).

The bug has existed since nginx 0.9.6 (2011, when `map` gained regex support). F5 — which owns nginx — shipped an out-of-band fix on 2026-07-15/16 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus R36 P7 and release 37.0.3.1, rating it CVSS 4.0 9.2 (critical) / CVSS 3.1 8.1 (high) ([SecurityWeek, 2026-07-16](https://www.securityweek.com/f5-patches-multiple-nginx-big-ip-vulnerabilities/)). F5's advisory frames real-world risk on ASLR-enabled systems as primarily denial-of-service — a characterization the credited discoverer directly disputes ([Stan Shaw, 2026-07-19](https://cyberstan.co.uk/nginx-rce/); [The Hacker News, 2026-07-19](https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html)). The credited discoverer, Stan Shaw, disputes the DoS-only framing and demonstrates two chainable primitives: an information-leak variant (a clobbered capture smaller than the original) that returns uninitialised heap residue — on Ubuntu 24.04 with glibc 2.39 a libc pointer at offset `0x08` and a heap pointer at `0x10`, enough to defeat ASLR in one unauthenticated GET — and a heap-overflow variant (a clobbered capture larger than the original) that writes attacker-controlled request-body content past the buffer and hijacks control flow through nginx's pool-cleanup mechanism, tested at 10/10 reliability with full ASLR enabled ([Stan Shaw, 2026-07-19](https://cyberstan.co.uk/nginx-rce/)). "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw told [The Hacker News (2026-07-19)](https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html).

No full exploit write-up or PoC is public yet — the author is withholding both for ~21 days post-patch — and no in-the-wild exploitation has been observed; the CVE is not in CISA KEV as of this run. The precedent the author cites is directly relevant: CVE-2026-42945 ("Rift"), a weaker flaw in the same nginx script engine that only mattered with ASLR disabled, "saw active exploitation shortly after its PoC dropped" ([Stan Shaw, 2026-07-19](https://cyberstan.co.uk/nginx-rce/); Rift's confirmed in-the-wild exploitation was covered here on 2026-05-18). This bug does not require ASLR to be off, so the same trajectory should be assumed once the withheld PoC ships (early August 2026 by the author's stated timeline).

**Defender takeaway:** nginx and NGINX Plus terminate internet-facing traffic across virtually every public-sector e-government portal, CI-operator API gateway and public service, so exposure is broad even though the trigger depends on a specific config pattern. Because F5's advisory understates the ceiling as DoS, treat this as a pre-auth RCE candidate on exposed edge and prioritise the out-of-band patch on that basis, not on the DoS reading. The config-pattern dependency is the discriminator that turns "patch everything" into "know your exposure first": most nginx deployments will not combine a regex capture with a later regex-`map` reference in one evaluated string, and the ones that do are the immediate-risk set. Detection is limited pre-PoC — the mechanism's observable signature is anomalously large or malformed request bodies immediately followed by nginx worker-process restarts/crashes on edge hosts (the DoS primitive's crash signature); a two-request info-leak-GET-then-overflow-POST shape is inferable from the mechanism but not a source-stated detection rule. The author's public static config scanner (`github.com/0xCyberstan/CVE-2026-42533-Config-Scanner`) follows `include`s, handles cross-directive triggering and distinguishes exploitable from safe ordering — run it against every internet-facing config now to enumerate which vhosts were exposed before you patch.