F5 released a patch on July 15 for CVE-2026-42533, a heap buffer overflow in the nginx map directive. The vulnerability affects nginx stable versions 0.9.6 through 1.30.3 and nginx mainline through 1.31.2, covering approximately 18 years of releases. Under conditions where ASLR is absent or can be defeated, a companion information leak in the same code path enables an unauthenticated attacker to achieve reliable remote code execution. As of July 20, no public exploit code has been published and CVE-2026-42533 is not yet on the CISA KEV catalog, but nginx is deployed on a significant fraction of internet-facing web servers globally.
The vulnerability
The flaw is in nginx's map module, which processes configuration-defined mappings of request variables to output values using string or regex matching. When the module applies a regex map operation to attacker-controlled content, a heap buffer overflow can be triggered. The same code path also exposes heap memory addresses through an information leak, providing a two-step attack surface: read heap addresses to defeat ASLR, then trigger the overflow with precise targeting.
The most common vulnerable configuration is nginx acting as a reverse proxy or load balancer where the map directive processes attacker-controlled HTTP request values such as headers, URL components, or query parameters. In these deployments, an attacker can reach the vulnerable code path without authentication or a prior foothold.
The exploit chain
The information leak and the heap overflow are triggered through the same code path. An attacker first sends a crafted request that causes the map regex processor to return heap memory addresses. Those addresses break ASLR on the target. The attacker then sends a second crafted request triggering the heap overflow, this time with precise control over the overflow target based on the leaked addresses.
F5's advisory confirms this chain produces reliable pre-auth RCE. The attack requires no authentication, no session state, and no prior foothold. The only requirement is that the map directive is processing attacker-controlled request content, which is the default behavior in a large number of nginx proxy configurations.
Affected versions and patch
Vulnerable: nginx stable 0.9.6 through 1.30.3 and nginx mainline through 1.31.2. Patched: nginx stable 1.30.4 and nginx mainline 1.31.3. For NGINX Plus: R36 P7 and 37.0.3.1.
All nginx installations running any version older than the patched releases are vulnerable. There is no configuration-level workaround that eliminates the vulnerability while retaining map directive functionality. The only complete fix is upgrading to nginx stable 1.30.4 or mainline 1.31.3.
What to do
Prioritize patching on internet-facing nginx instances acting as reverse proxies or load balancers. These are the highest-risk deployments because they are most likely to have the map directive processing attacker-controlled content and are directly reachable from untrusted networks without requiring any prior access.
If an immediate upgrade is not possible, review your nginx configuration for map directives that process attacker-controlled input sources such as request headers, URI components, or query parameters. If the map directive is not in active use, disabling the module provides the lowest-effort risk reduction. If it is in active use and cannot be immediately patched, treat the deployment as high-risk and implement additional network controls to limit exposure while the patch is scheduled.
Monitor the CISA KEV catalog for CVE-2026-42533. If it is added, active exploitation has been confirmed. Most organizations should treat any confirmed active exploitation of a pre-auth RCE in nginx as a trigger for emergency patching regardless of their FCEB status.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing your nginx deployment risk or working through a patch prioritization question.