CVE-2026-42533 is a critical (CVSS 9.2) unauthenticated heap buffer overflow in NGINX Plus and NGINX Open Source that lets a remote attacker crash the worker process, and potentially run code, with crafted HTTP requests. Affected builds are NGINX Open Source 0.9.6–1.31.2 and NGINX Plus before R37 P1; fixed in 1.30.4 / 1.31.3 and NGINX Plus 37.0.3.1. Patch now. F5 disclosed CVE-2026-42533 in an out-of-band advisory (K000162097) on July 15, 2026, the lead item among eight NGINX and BIG-IP fixes shipped that day.

The flaw is a heap buffer overflow (CWE-122) in NGINX's two-pass script engine. It triggers when a map directive uses regex matching and a string expression references the map's regex capture variables before the output variable is evaluated, evaluation between the two passes overwrites shared capture state on the heap. An unauthenticated attacker can reach it by sending crafted HTTP requests to any vhost whose configuration uses that pattern, crashing the NGINX worker process. On systems where ASLR is disabled, or when paired with an ASLR bypass, F5 says it "may... trigger a code execution." It is a data-plane-only issue with no control-plane exposure.

CVE-2026-42533 matters because of where NGINX sits. NGINX fronts a large share of the world's websites and APIs as a web server, reverse proxy, and load balancer, so the population of internet-facing instances that terminate attacker-reachable HTTP is enormous. The exposure narrows to deployments whose config actually uses the vulnerable map regex-capture pattern, which is exactly why knowing your configuration, not just your version string, is the whole game here.

Which NGINX versions are affected by CVE-2026-42533?

CVE-2026-42533 affects a wide span of NGINX builds going back to 0.9.6. Check your running version against the fixed release for your branch:

The flaw scores CVSS 9.2 under CVSS v4 (8.1 under v3.1) and carries CWE-122. Notably, its EPSS exploitation-probability score has climbed since disclosure, from roughly the 53rd percentile in mid-July to 3.6% / 88.2nd percentile as of July 29, 2026, even though it remains absent from CISA KEV. That upward drift is the kind of signal that a static "CVSS 9.2, not in KEV" snapshot misses.

How do I find and fix CVE-2026-42533 in my config?

Upgrading is the fix: move to NGINX Open Source 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1, per F5 advisory K000162097. Before and after patching, audit your configuration for the vulnerable pattern rather than assuming you are unaffected. The trigger is a map block with a regex key whose value references a numbered capture ($1, $2, …) that is resolved before the map's output variable. A first-pass sweep of your NGINX config tree:

# flag map blocks that use regex captures, review each match by hand
grep -RInE 'map\s+.*\$' /etc/nginx/ | grep -E '~'
grep -RInE '\$[0-9]' /etc/nginx

Any map that combines a regex key (~) with a numbered capture in its result is a candidate. F5's documented interim workaround is to switch those numbered captures to named captures, but one researcher found a narrower path that survives this mitigation, so treat the workaround as temporary cover until you patch. Patch the other seven fixes from the same batch in the same window: NGINX slice and SSI module issues, an NGINX Ingress Controller config-injection flaw, and a separate unauthenticated BIG-IP HTTP/2 denial-of-service.

Is CVE-2026-42533 being exploited in the wild?

F5 reports no in-the-wild exploitation and there is no public proof-of-concept as of late July 2026, and the CVE is not in CISA KEV. The realistic near-term outcome is denial of service from repeated worker crashes; reliable code execution requires defeating ASLR, which is on by default on modern Linux. But the trigger is a configuration pattern an attacker can probe blindly against exposed hosts, and the rising EPSS score says the model increasingly expects exploitation, so "no PoC yet" is a timing statement, not an all-clear.

Does CVE-2026-42533 affect BIG-IP?

No, the critical CVE-2026-42533 is an NGINX data-plane bug, not a BIG-IP core flaw. Among the eight fixes in the July 15 batch, BIG-IP is affected by a separate unauthenticated HTTP/2 denial-of-service issue that should be patched alongside it, but it is a distinct vulnerability.

Our read

An unauthenticated 9.2 in one of the world's most widely deployed web servers is textbook edge exposure, the internet-facing weakness that continuous, automated validation surfaces long before the next scheduled pentest. The EPSS jump from the 53rd to the 88th percentile in two weeks is the concrete argument against point-in-time triage: the same CVE that read "probably fine, not in KEV" on July 15 reads meaningfully hotter on July 29, and nothing about the host changed, only the exploitation signal did. Our published analysis of the 2025 KEV data found the median gap from disclosure to first exploitation is just 26 days, and 20% of exploited flaws were hit on or before disclosure day; the clock started when F5's patch revealed the bug. Knowing which of your NGINX instances actually run the vulnerable map pattern, not just which version they report, is what closes the window before that clock runs out.

Frequently asked questions

Which NGINX versions are affected by CVE-2026-42533, and which fix it? NGINX Open Source 0.9.6 through 1.31.2 (fixed in 1.30.4 stable and 1.31.3 mainline) and NGINX Plus before R37 P1 (fixed in 37.0.3.1).

Does CVE-2026-42533 affect NGINX Open Source or only NGINX Plus? Both. Only the fixed builds above are safe.

Can CVE-2026-42533 be exploited remotely without authentication? Yes, it is a remote, unauthenticated heap buffer overflow (CWE-122) in the NGINX worker process, triggered by a crafted HTTP request against a vhost using the vulnerable map pattern.

Is there a public exploit or PoC for CVE-2026-42533? No confirmed public PoC or in-the-wild exploitation as of late July 2026, but its EPSS score has risen to the 88th percentile, treat it as urgent.

How do I check if my NGINX config is vulnerable? Audit your config tree for map blocks that pair a regex key (~) with a numbered capture ($1) referenced before the output variable; grep patterns are in the section above.

Where is the official F5 advisory for CVE-2026-42533? F5 security advisory K000162097 and the NVD record; both are linked below.

Sources: SecurityWeek · F5 advisory K000162097 · NVD, CVE-2026-42533

Reporting by SecurityWeek and The Hacker News; version detail per The Hacker News; technical details, CVSS 9.2 and CWE-122 per F5's advisory K000162097 and NVD; EPSS per FIRST.org.

Related: OpenWrt DHCPv6 unauthenticated root RCE (CVE-2026-53921) · What CVSS misses: EPSS, KEV and patch prioritization