CVE-2026-42533: nginx heap buffer overflow with map regex captures (major)

Critical 9.2 EPSS 6.3% nginx

When a map directive uses regex matching and a string expression references the regex capture variables before the map's own output variable (or, in some cases, uses a non-cacheable variable), nginx can overflow a heap buffer in the worker process. Unauthenticated crafted HTTP requests can crash workers, and F5 says code execution is possible where ASLR is disabled or can be bypassed. nginx rates it major; nginx 0.9.6 through 1.31.2 is affected, which covers every supported distro package.

• CVE-2026-42533CVE identifier
• 9.2CVSS 4.0 base score (critical)
• 6.3%EPSS: chance of exploitation in the next 30 days (higher than 94% of CVEs)
• 2026-07-15published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• nginx 0.9.6 through 1.31.2 (fixed in 1.30.4 stable and 1.31.3 mainline)
• NGINX Plus R33 and later before R36 P7, and 37.0.0.1 before 37.0.3.1

Fixed in:

• nginx 1.30.4
• nginx 1.31.3
• NGINX Plus R36 P7
• NGINX Plus 37.0.3.1

Am I affected?

nginx -v
sudo nginx -T 2>/dev/null | grep -nE '^\s*map\s'
dpkg -l 'nginx*' | grep ^ii
rpm -q nginx

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade nginx nginx-common nginx-core nginx-light nginx-full nginx-extras
sudo systemctl restart nginx

sudo apt update
sudo apt install --only-upgrade nginx nginx-common nginx-core nginx-light nginx-full nginx-extras
sudo systemctl restart nginx

sudo dnf upgrade --refresh nginx
sudo systemctl restart nginx

sudo dnf upgrade --refresh nginx nginx-core

sudo zypper refresh
sudo zypper update nginx
sudo systemctl restart nginx

sudo dnf upgrade --releasever=latest nginx nginx-core

sudo pacman -Syu

apk update && apk upgrade nginx

pkg update && pkg upgrade nginx (or nginx-full)

Upgrade to nginx 1.30.4 (stable) or 1.31.3 (mainline) or later from https://nginx.org/en/download.html, then restart nginx.

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat: do not use unnamed regex captures; use named captures instead and only use them in the same block as the regex match.
• Only configurations that use map with regex matching (or the non-cacheable-variable variant described by nginx) are affected.

Related vulnerabilities

• CVE-2026-60005
• CVE-2026-56434

Sources

• nginx security advisories
• nginx 1.30 changelog (1.30.4)
• F5 article K000162097
• CVE record CVE-2026-42533
• Debian DSA-6496-1 nginx
• Debian security tracker
• Ubuntu CVE page
• Red Hat CVE page
• SUSE CVE page
• CVE-2026-42533 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.