Executive Summary
A critical vulnerability in NGINX (CVE-2026-42533, also referenced as NGINX Rift CVE-2026-42945) enables remote, unauthenticated attackers to crash worker processes and, under certain conditions, achieve remote code execution (RCE). This flaw impacts a broad spectrum of NGINX deployments, including NGINX Open Source, NGINX Plus, and several F5 products. Exploitation is contingent on specific configuration patterns but has been confirmed as practical and, in some cases, already observed in the wild. Immediate patching is strongly advised due to the criticality and ubiquity of NGINX in enterprise and cloud environments.
Technical Information
The vulnerability, tracked as CVE-2026-42533 (primary) and CVE-2026-42945 (NGINX Rift, related), carries a CVSS score of 9.2, reflecting its critical severity. All NGINX versions from 0.9.6 through 1.31.2 are affected, including all corresponding NGINX Plus releases and derivative products such as NGINX Ingress Controller, Gateway Fabric, App Protect WAF, Instance Manager, F5 WAF for NGINX, and NGINX App Protect DoS.
The vulnerability resides in the NGINX script engine, specifically in the handling of regex-based map directives and string expressions referencing regex captures. The flaw is triggered when a crafted HTTP request targets a server with a vulnerable configuration—namely, a regex-based map whose output variable is referenced in a string expression after a capture from an earlier regex match. This sequence causes a heap buffer overflow in the worker process.
The exploitation flow is as follows: An attacker sends a specially crafted HTTP request to a vulnerable endpoint. Due to a miscalculation in buffer size during NGINX’s two-pass evaluation (caused by overwritten capture state between passes), the buffer is overrun with attacker-controlled data. This can result in denial of service (DoS) via worker crash/restart, or, if address space layout randomization (ASLR) is disabled or bypassed, remote code execution. Notably, researchers have demonstrated that the flaw itself can leak heap addresses, potentially enabling RCE even with ASLR enabled.
A typical vulnerable configuration involves a regex-based map and a location block that references both the map output and a regex capture, as shown below:
map $request_uri $foo {
~regex $1;
}
server {
location ~ /path/(.*) {
set $bar "${foo}_$1";
# vulnerable if $foo is derived from a regex map and $1 is a capture
}
}
The attacker can manipulate heap layout (heap feng shui) to overwrite function pointers, such as cleanup handlers, and execute arbitrary code. The vulnerability is particularly dangerous because it can be exploited remotely and without authentication, and because NGINX is widely deployed as a reverse proxy, load balancer, and application delivery controller.
Exploitation in the Wild
As of July 20, 2026, there is no public exploit code for CVE-2026-42533, but researchers, notably a researcher known as cyberstan, have confirmed practical exploitation and plan to release proof-of-concept (PoC) code 21 days after the patch. Previous related exploits, such as NGINX Rift (CVE-2026-42945), were published within days of disclosure and saw active exploitation soon after. Indicators of compromise include unusual HTTP requests with heavily encoded payloads or abnormal URL patterns, repeated worker process crashes or restarts, and heap spray attempts via POST request bodies.
It is important to note that, according to the latest CISA KEV catalog (as of July 16, 2026), CVE-2026-42533 is not listed. Therefore, there is no CISA-confirmed evidence of active exploitation at this time.
APT Groups using this vulnerability
There is currently no specific attribution to any advanced persistent threat (APT) group for exploitation of CVE-2026-42533 or CVE-2026-42945. Both MITRE and open sources do not list any APT group using these vulnerabilities as of July 2026. However, given the criticality and ubiquity of NGINX, exploitation by both financially motivated and state-sponsored actors is highly likely once public PoCs are available.
Affected Product Versions
The affected products include all versions of NGINX Open Source from 0.9.6 up to and including 1.31.2, all versions of NGINX Plus based on these core versions, and derivative products such as NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF, NGINX Instance Manager, F5 WAF for NGINX, and NGINX App Protect DoS. Patched and not vulnerable versions are NGINX 1.30.4 (stable), NGINX 1.31.3 (mainline), and NGINX Plus 37.0.3.1. For a complete mapping of affected and patched versions, consult the NGINX Security Advisories and F5 Security Advisory.
Workaround and Mitigation
The only complete mitigation is to upgrade to NGINX 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1. As a temporary measure, switching affected regex maps to named captures may reduce exposure, but this does not fully mitigate all exploitation paths. Organizations should audit their configurations for regex-based maps whose variables are referenced in string expressions alongside numbered captures from earlier regexes. Monitoring for indicators of compromise, such as abnormal HTTP requests, worker crashes, and heap spray attempts, is also recommended.
Indicators of Compromise
The following table presents indicators of compromise (IOCs) extracted from public sources. These indicators are point-in-time and should be validated before enforcement in your environment.
Type | Indicator | Reported (date) | Source
|
IPv4 | 37[.]0[.]3[.]1 | 2026-07-19 |
References
- NGINX Official Security Advisories
- The Hacker News: Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
- Picus Security: NGINX Rift CVE-2026-42945 Critical Heap Buffer Overflow Vulnerability Explained
- DepthFirst: NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
- F5 Security Advisory
- CISecurity Advisory
Rescana is here for you
Rescana provides a comprehensive third-party risk management (TPRM) platform that empowers organizations to continuously monitor, assess, and mitigate cyber risks across their supply chain and digital ecosystem. Our platform delivers actionable intelligence, automated workflows, and deep visibility into vendor security posture, helping you stay ahead of emerging threats and regulatory requirements. We are happy to answer any questions at info@rescana.com.
