Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has issued patches for a severe vulnerability in NGINX that could allow remote code execution under certain conditions. The flaw, tracked as CVE-2026-42533, was addressed on July 15 in nginx versions 1.30.4 (stable) and 1.31.3 (mainline), along with NGINX Plus 37.0.3.1. Attackers can exploit this by sending specially crafted HTTP requests to trigger a heap buffer overflow in the worker process.

While primarily a denial-of-service vector, the vulnerability may enable remote code execution if address space layout randomization (ASLR) is disabled or bypassed. This occurs due to a misalignment in the script engine’s two-pass evaluation of regex-based map directives used in string expressions. A researcher named Stan Shaw argues that the flaw provides a method to bypass ASLR itself, potentially making it more dangerous than F5 acknowledges.

F5 rates the vulnerability as high severity, with a CVSS v4 score of 9.2. All versions from 0.9.6 up to 1.31.2 are affected, spanning over a decade of NGINX usage. While mitigation options exist—like using named captures instead of numbered ones—Shaw warns these do not fully resolve the issue. He recommends upgrading immediately to the latest stable or mainline releases.