nginx map directive regex-capture heap buffer overflow in worker
A heap buffer overflow in the nginx worker process when a map directive's string expression references its regex capture variables before the output variable. Reachable via crafted HTTP; DoS by worker restart, code execution possible only where ASLR is disabled or bypassable.
- Vendor
- F5
- Product
- nginx (open source), NGINX Plus
- CVSS
- 8.1
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-42533 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-42533 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
Fixed builds: nginx 1.30.4 (stable branch), nginx 1.31.3 (mainline branch), and NGINX Plus 37.0.3.1. Anyone on an earlier build should upgrade.
The vulnerability exists when a map directive uses regex matching and a string expression references the map’s regex capture variables before the map output variable — or, per NVD, when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated remote attacker who can reach the listener and whose request lands against a config carrying that shape can trigger a heap buffer overflow in the worker process, forcing a restart (denial of service) and, on systems where address-space layout randomization is disabled or can be bypassed, potentially executing code. Control plane is not exposed; this is a data-plane issue only.
Per the NVD entry, builds that have reached End of Technical Support are not evaluated by this advisory. Interim mitigation, if patching is delayed: audit map blocks for string expressions that reference regex capture variables before the map output variable, and restructure or remove them.
Other F5 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97205 NGINX HTTP/3 use-after-free in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | 0.5% | — |
| CVE-2026-93479 NGINX map directive use-after-free and buffer overflowwrite-up | [ HIGH ] | 8.1 | 0.6% | — |
| CVE-2026-15176 NGINX HTTP/3 heap buffer overflow in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | 0.5% | — |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 2.2% | |
| CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 2.3% | |
| CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability | [ HIGH ] | 8.8 | 4.5% | |
| CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.5% | |
| CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
