CVE-2026-42533

Name of the Vulnerable Software and Affected Versions NGINX Open Source versions 0.9.6 through 1.30.3 NGINX Open Source version 1.31.2 NGINX Plus R33 through R36 NGINX Plus versions 37.0.0.1 through 37.0.2.1

Description A heap buffer overflow exists in the NGINX worker process due to a flaw in the two-pass evaluation engine where the PCRE capture state is not saved and restored. This occurs when a map directive uses regex matching and a string expression references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests, potentially leading to a denial-of-service (DoS) via worker process restarts or remote code execution (RCE) on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. The issue affects both HTTP and stream modules and is triggered by specific configuration patterns involving directives such as proxy set header, proxy pass, rewrite, add header, root, and set.

Recommendations Update NGINX Open Source to version 1.30.4. Update NGINX Open Source to version 1.31.3. Update NGINX Plus to R36 P7. Update NGINX Plus to version 37.0.3.1. As a temporary mitigation, audit configurations to identify and remove patterns that combine regex captures with regex map variables in the same evaluation path.