Cybersecurity

The nginx Patch Is Out, the Exploit Lands in August

CVE-2026-42533 affects nginx builds back to 2011. The fix shipped 15 July and a proof of concept is promised 21 days later. You can check your own exposure.

CybersecurityBy Servola Tech Desk2026-07-204 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The nginx Patch Is Out, the Exploit Lands in August

Key takeaways

CVE-2026-42533 carries a CVSS 9.2 and affects nginx 0.9.6 through 1.31.2, which is every build since 2011, and the fixed releases are 1.30.4 stable, 1.31.3 mainline and NGINX Plus 37.0.3.1.
The flaw only fires on a specific configuration shape, so search your nginx config for a regex-based map directive whose output variable is used in a string expression after a numbered capture such as dollar-one or dollar-two.
There is no public exploit code and no CISA listing as of 20 July, but the researcher who analysed the flaw has said he will publish a proof of concept 21 days after the patch, which puts early August on your calendar.
F5 advisory K000162097 offers a configuration mitigation, switching affected regex maps to named captures, which means you can reduce exposure yourself without waiting for a hosting provider to schedule a version upgrade.
This is the third heap overflow found in the same expression-evaluation code in two months, so treat the subsystem rather than the single CVE as the thing to watch on your next review.

A fix landed on 15 July for code written in 2011

On 15 July 2026 the nginx project shipped 1.30.4 and 1.31.3, and the release closed a heap buffer overflow that had been reachable in every version going back to 0.9.6. That release dates from 2011. The vulnerability is tracked as CVE-2026-42533 and scored 9.2 on the CVSS version 4.0 scale, with F5 publishing advisory K000162097 for NGINX Plus customers, fixed in 37.0.3.1.

The credit list is unusual. More than a dozen researchers reported the same problem independently, with Mufeed VH of Winfunc Research named among them and long-standing maintainer Maxim Dounin handling the fix. When a flaw is found by that many people at once, the reasonable assumption is that it was not hard to find, and that other people found it without filing a report.

What has to be in your config for this to matter

The bug lives in the script engine, which evaluates the string expressions nginx builds at request time. That evaluation runs in two passes. The first pass measures how large a buffer needs to be, using the capture state as it stands at that moment. The second pass writes into that buffer using capture data the request can influence. Where the two passes disagree, the write is larger than the space reserved for it.

The trigger is narrower than the version range suggests. It needs a regex-based map directive whose output variable is referenced in a string expression after a capture from an earlier regex match, the numbered captures written as dollar-one and dollar-two. If your configuration contains no regex map of that shape, the version number alone does not put you in the affected set. That is the single most useful fact in this disclosure.

Unauthenticated, but not yet weaponised

Where the pattern is present, the request that triggers it needs no credentials. A crafted HTTP request from anywhere on the internet reaches it. The reliable outcome is a worker process crash and restart, which is a denial of service against the front door of whatever the server publishes. Remote code execution is the harder case, available where address space layout randomisation is disabled or can be defeated, and researcher Stan Shaw has argued the flaw supplies its own route around that protection.

As of 20 July there is no public exploit code and the CVE does not appear in the United States Known Exploited Vulnerabilities catalogue. That is the current state, not a forecast. Shaw has said he intends to publish a proof of concept 21 days after the patch shipped, which places it in the first week of August. An unexploited critical with a published date attached is a different planning problem from one without.

Three overflows in one subsystem in two months

CVE-2026-42533 is not an isolated find. It is the third heap overflow disclosed in nginx expression-evaluation code within roughly two months, after CVE-2026-42945 in May and CVE-2026-9256 shortly after it. Three findings in one subsystem in one quarter is a pattern rather than a coincidence, and the pattern says the two-pass design is being actively picked over by people who now know where to look.

The consequence for planning is straightforward. If you treat this as a single version bump and move on, the probability that you are back here within the quarter is meaningfully above zero. The subsystem, not the CVE number, is the thing to put on the watch list, and the configuration shapes that reach it are the thing to reduce permanently.

The check to run before you phone your host

Most critical web server disclosures leave a business owner dependent on somebody else. This one does not, because the trigger is legible in a file you can read. Ask for your nginx version, then ask whether any map block in the configuration uses a regular expression and feeds a variable that is later combined into a string alongside numbered captures. Two questions, one answer, and you know whether early August is a deadline or a note.

For companies inside the scope of the Network and Information Security Directive across the European Union, and for those following the equivalent United Kingdom guidance, the documentation matters as much as the patch. Record the version you were on, the date you checked the configuration, and the mitigation you applied. A regulator asking about a critical published in July will want the date you assessed it, not only the date you eventually upgraded.

Frequently asked questions

Am I affected if I run an old nginx but have no regex map?

The affected version range runs from 0.9.6 to 1.31.2, but the reported trigger requires a regex-based map directive whose output variable is used in a string expression after a numbered capture. Without that configuration shape the described path is not reachable. Upgrading is still the correct end state, because the version range tells you the code is present even when your current configuration does not reach it.

Should I patch now or wait for a maintenance window?

There is no public exploit code as of 20 July and the researcher has signalled a proof of concept about 21 days after the 15 July patch. That gives a genuine window rather than an emergency, and it ends in early August. If you cannot upgrade before then, apply the configuration mitigation in F5 advisory K000162097 by moving affected regex maps to named captures.

Does the configuration mitigation fully replace the upgrade?

No. It reduces exposure while an upgrade is scheduled. The researcher who analysed the flaw has described a narrower secondary path that remains after the named-capture change, so treat the configuration edit as the interim step and 1.30.4, 1.31.3 or NGINX Plus 37.0.3.1 as the resolution.

The version range is fifteen years wide, but the trigger is one configuration shape you can read in your own file. That is a rare amount of control in a critical disclosure, and it expires when the proof of concept publishes.

nginxCVE-2026-42533F5web serverspatch managementNIS2

WordPress Patched Friday, Exploits Came Sunday

Two WordPress core flaws were patched on 17 July. By Sunday VulnCheck counted more than two dozen public exploits. The patch window was a single evening.

5 min read

Cybersecurity

The Fix Was Public 81 Days Before the Warning

A malicious config.json could run code on any machine loading a public AI model, bypassing trust_remote_code=False. The patch shipped 4 March. The CVE landed 24 May.

4 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles