CVE-2026-42533: NGINX RCE Flaw with PoC (CVSS 9.2)

Published on 31 July 2026

CVE-2026-42533: Critical NGINX Flaw with PoC – RCE via TLS

A single, unauthenticated HTTP request can be enough to crash an NGINX web server – or worse: to execute arbitrary malicious code on the server. That is exactly what CVE-2026-42533 makes possible, a critical vulnerability in the world's most widely used web server. Since 28 July 2026, a public, fully functional exploit has existed that bypasses the system's memory randomisation (ASLR) and reliably achieves remote code execution. Anyone running NGINX should act now.

What happened?

On 15 July 2026, F5 – the vendor behind NGINX – published security advisory K000162097 and made patches available for a critical vulnerability. It carries the identifier CVE-2026-42533 and received a CVSS v4.0 score of 9.2 (Critical) in the official CVE database NVD – one of the highest possible values.

The core of the problem: a heap buffer overflow – an error in which more data is written into a reserved memory area than it can hold, overwriting adjacent memory. The vulnerability was discovered by security researcher Stan Shaw (known as "cyberstan"), who responsibly reported it to the F5 Security Incident Response Team on 17 May 2026 – including full proof that it can be leveraged for remote code execution.

Especially explosive: on 28 July 2026, just 13 days after the patch, the team "DepthFirstDisclosures" published a complete exploit-chain PoC (proof-of-concept, i.e. a working demonstration of feasibility) on GitHub. This puts the attack code in everyone's hands. As of our research on 31 July 2026, no active exploitation "in the wild" has been confirmed yet and the vulnerability is not listed in the CISA KEV catalogue – however, given the public PoC, the risk must be rated as high.

The technical background – explained clearly

To understand why this vulnerability is so tricky, it helps to look at how NGINX works. The web server assembles composed strings – for example in directives such as proxy_set_header, add_header or return – using a two-pass procedure:

LEN pass (first run): NGINX calculates how large the required memory buffer must be and reserves it.
VALUE pass (second run): The actual data is written into this previously reserved buffer.

Both runs read from the same memory area, which contains the results of regex groups (the so-called captures, i.e. the matches of regular expressions such as $1, $2). The problem arises when a map directive with a regular expression overwrites these captures between the two runs: the LEN pass reserved the buffer for the original, smaller value – but the VALUE pass then writes the longer, attacker-controlled value into it. The result is an out-of-bounds write, i.e. a write access beyond the buffer boundary.

The flaw also works the other way round: if the overwriting value is smaller than the original, an oversized buffer with uninitialised memory content is left behind – and this is returned in the server's response. In this way, attackers gain access to internal memory addresses and can defeat the ASLR protection (Address Space Layout Randomization, the random arrangement of memory areas).

This is precisely what discoverer Stan Shaw emphatically points out:

"A reader of the F5 advisory could reasonably conclude that on standard systems this is only a DoS. It is not. The bug ships the bypass itself. […] On a standard Ubuntu 24.04 build, a single unauthenticated GET request recovers the addresses a payload needs. Tested at 10-out-of-10 reliability on Ubuntu 24.04 with glibc 2.39 and ASLR fully enabled." – Stan Shaw, The Hacker News

The PoC by DepthFirstDisclosures combines three steps: first, a memory leak is used to recover the bas

Step by step

How the attack unfolded

Click a phase for details – or let the animation play through.

PHASE 1/5 · Reconnaissance

The attacker identifies vulnerable NGINX servers using susceptible map directives with regex captures.

T1595 – Active Scanning T1592 – Gather Victim Host Information

Target: NGINX Open Source 0.9.6–1.31.2 and NGINX Plus R33–R36
Over 4.6 million affected installations worldwide
Config scanner (0xCyberstan) checks for unnamed regex captures
Affected: proxy_set_header, add_header, return combined with map + regex

PHASE 2/5 · Initial Access

A single unauthenticated HTTP request triggers a heap buffer overflow via CVE-2026-42533.

T1190 – Exploit Public-Facing Application

CVE-2026-42533, CVSS v4.0 score 9.2 (Critical)
Flaw in the two-pass process (LEN pass / VALUE pass) during string assembly
map directive overwrites regex captures between the two passes
Result: out-of-bounds write in the NGINX worker process

PHASE 3/5 · Defense Evasion

A memory leak returns internal addresses, defeating ASLR protection.

T1211 – Exploitation for Defense Evasion

Reverse flaw: oversized buffer returns uninitialized memory in the server response
Leak exposes internal memory addresses to bypass ASLR
A single unauthenticated GET request recovers the required addresses
Tested with 10/10 reliability on Ubuntu 24.04 with glibc 2.39 and ASLR enabled

PHASE 4/5 · Execution

Using the leaked addresses, the heap overflow is escalated to remote code execution.

T1203 – Exploitation for Client Execution

Public exploit-chain PoC (DepthFirstDisclosures / Nginx-Rift) on GitHub since 2026-07-28
PoC combines memory leak (ASLR bypass) + RCE via stream module
Attacker-controlled longer value overwrites adjacent heap memory
Code execution in the context of the NGINX worker process

PHASE 5/5 · Impact

The attack causes at least a server crash, or in the worst case full compromise.

T1499 – Endpoint Denial of Service T1496 – Resource Hijacking

Minimal effect: restart of the NGINX worker process (DoS)
Maximal effect: full remote code execution on the server
Patches available: NGINX Open Source 1.30.4/1.31.3, NGINX Plus 37.0.3.1/R36 P7
Mitigation: avoid using unnamed regex captures

Short & clear answers

Frequently asked questions about this incident

Am I affected by CVE-2026-42533?

Affected products include NGINX Open Source versions 0.9.6 to 1.31.2 (stable 1.30.0–1.30.3), NGINX Plus R33–R36, and many others such as NGINX Ingress Controller and NGINX App Protect WAF. It also depends on whether your configuration uses a map directive with regular expressions and capture variables ($1, $2). Check your NGINX version with 'nginx -v' and review your configuration.

What should I do right now?

Immediately install the patches released by vendor F5 on July 15, 2026: NGINX Open Source 1.30.4 or 1.31.3, or NGINX Plus 37.0.3.1 or R36 P7. Since a fully functional exploit has been publicly available since July 28, 2026, this update is high priority. As an interim measure, NGINX also recommends avoiding unnamed captures in map directives.

How dangerous is this vulnerability really?

The flaw carries a CVSS v4.0 score of 9.2 (Critical), one of the highest possible ratings. A single unauthenticated HTTP request can crash the web server or, on vulnerable systems, lead to Remote Code Execution. According to researcher Stan Shaw, the published exploit even bypasses ASLR protection with 10 out of 10 reliability on standard Ubuntu 24.04 systems.

Is the vulnerability already being actively exploited?

As of the research date on July 31, 2026, no active exploitation 'in the wild' has been confirmed, and the flaw is not listed in the CISA KEV catalog. However, a complete exploit-chain PoC was publicly released on GitHub on July 28, 2026, making the attack code available to anyone. The risk is therefore considered high.

Could I face legal consequences if I don't update?

Running a website with known, outdated software can result in GDPR fines – the Data Protection Authority of Lower Saxony imposed a fine of 65,500 euros in one case. If the vulnerability leads to a compromise of personal data, a data breach notification obligation may also apply. Promptly applying the patches significantly reduces this risk.