CVE-2026-42533Patch(f5 / nginx_gateway_fabric)

CRITICALCVSS 9.2 · CRITICAL

Exploitation observed; activity peaked at 52 mentions and remains active

Immediate actions

Patch f5 nginx_gateway_fabric systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

f5 CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://my.f5.com/manage/s/article/K000162097

Weakness type (CWE)

CWE-122

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nginx_gateway_fabric
nginx_ingress_controller
nginx_plus
waf

Threat summary

Active exploitation appears in 11 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
141 mentions across 25 observed days

What's happening

Active exploitation reported across 11 signals
Exploit tool or code specified in 16 signals
PoC mentioned or linked in 38 signals
Patch or workaround mentioned in 64 signals
Technical details provided in 113 signals
Disclosure: 38 classified signals
Peaked 20d ago at 52 mentions (2026-07-20); latest day: 2
141 total mentions across 25 days

Affected systems

Vendors

Products

nginx_gateway_fabricnginx_ingress_controllernginx_pluswaf

3 versions affected across 4 products

Deep dive

Activity timeline141 mentions / 25d

Signal classification6 categories

Patch

5136.2%

Disclosure

3827.0%

PoC

2215.6%

General

1510.6%

Active Exploitation

85.7%

Exploit

75.0%

Referenced assets85 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Disclosure1
2026-07-16	14	Disclosure3General2Patch9
2026-07-18	2	General1PoC1
2026-07-19	10	Active Exploitation2Disclosure2General1Patch5
2026-07-20	52	Active Exploitation2Disclosure16General8Patch19PoC7
2026-07-21	14	Disclosure5General1Patch6PoC2
2026-07-22	5	Patch5
2026-07-23	3	Disclosure2Patch1
2026-07-24	1	Disclosure1
2026-07-25	2	Exploit1PoC1
2026-07-27	5	Disclosure2Exploit1PoC2
2026-07-28	9	Disclosure2Exploit1General1Patch2PoC3
2026-07-29	7	Disclosure2Patch1PoC4
2026-07-30	1	PoC1
2026-07-31	1	Patch1
2026-08-02	1	Patch1
2026-08-03	1	Disclosure1
2026-08-04	2	Active Exploitation2
2026-08-05	3	Exploit2PoC1
2026-08-17	1	General1
2026-08-31	1	Active Exploitation1
2026-09-01	1	Exploit1
2026-09-13	1	Active Exploitation1
2026-09-14	1	Disclosure1
2026-09-19	2	Exploit1Patch1

Full discourse20 posts

The Hacker News@TheHackersNews87d
Disclosure
🛑 WARNING - A new critical NGINX vulnerability that has existed for 15-years lets unauthenticated attackers crash worker processes with crafted HTTP requests. CVE-2026-42533 affects specific regex map configurations. F5 says it may also allow pre-auth RCE if ASLR is disabled or bypassed. Read how the bug works: https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html
Post summary
A newly disclosed NGINX flaw, existing for 15 years, can crash workers and potentially enable remote code execution if ASLR is bypassed, but no PoC, exploit, or patch information is provided yet.
1314410430188154.7K
2.3M followersView on X
Zhenpeng (Leo) Lin@Markak_82d
Exploit
Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently by multiple groups. Our team at @depthfirstlabs caught it using our internal systems, right alongside CVE-2026-42530, a separate issue in NGINX’s HTTP/3 QPACK implementation.
Post summary
A PoC/exploit for NGINX CVE-2026-42533 is open-sourced, highlighting powerful RCE with info leak and ASLR bypass; no evidence of active exploitation or patch status is provided.
789337722730.5K
3.6K followersView on X
The Hacker News@TheHackersNews78d
Exploit
🚨 UPDATE - Public PoC exploit released for CVE-2026-42533, chaining an #nginx memory leak and heap overflow to bypass ASLR and achieve unauthenticated command execution. Read: https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html
Post summary
A public proof‑of‑concept exploit for CVE‑2026‑42533 has been released, demonstrating how a memory‑leak/heap‑overflow chain can bypass ASLR to achieve unauthenticated command execution.
384532515866.0K
2.3M followersView on X
Aikido Community Japan@AikidoCommJP87d
Patch
【緊急】NGINX に深刻な脆弱性 CVE-2026-42533（CVSS 9.2 / Critical） ※NGINX公式アドバイザリで確認済み ■ 対象 NGINX を使っているなら要確認。2011年以降のほぼ全バージョン（0.9.6〜1.30.3、および1.31.2）が対象です。認証なし・リクエストを送るだけでワーカープロセスのメモリを破壊でき、最低でもサービス停止、条件次第で遠隔コード実行（RCE）。 ■ でも全滅ではない実際に刺さるのは特定の設定を使っている場合だけ。まず自分の環境を確認するのが先です。 ■ 調べ方（コピペでOK） ① バージョン確認 nginx -v ② 設定をチェック nginx -T 2>/dev/null | grep -nE 'map |~' → 何も表示されなければ、この脆弱性には該当しない可能性が高いです。 → 何か表示されたら、その設定を詳しく確認してください。 ※この grep は簡易チェックです。最終的な影響の有無は、設定内容の確認か専用スキャナで判断を。 → 自動判定スキャナ（includeも追う） http://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner ■ 直し方・修正版へ更新：1.30.4 または 1.31.3（NGINX Plus は 37.0.3.1）・OSのパッケージで入れている人は apt / yum の更新で修正が来る（バージョン番号が上がらなくてもOK）・すぐ上げられない場合の暫定回避もあるが、あくまで時間稼ぎ。早めの更新を。 ■ ここが怖い NGINX は WordPress やクラウドと違い、自動更新で勝手に塞がらない。誰かが手を動かすまで脆弱なまま残るので、放置サーバほど危ない。PoC は近く公開予定で、猶予は多くありません。 https://cyberstan.co.uk/nginx-rce/ #NGINX #CVE202642533 #サイバーセキュリティ
Post summary
The post announces critical CVE-2026-42533 in NGINX, supplies patch recommendations, and previews a PoC but does not provide exploit code or report active attacks.
171426121841.8K
846 followersView on X
Cyber Security News@The_Cyber_News87d
Disclosure
🔴 A newly disclosed flaw tracked as CVE-2026-42533 affects nginx's script engine and has been silently exploitable since March 2011, when the map directive gained regex support. The vulnerability is a pre-authentication remote code execution flaw rooted in a missing save/restore of PCRE capture state in nginx's internal script engine. ❗️Heap buffer overflow: when the clobbered capture is larger than the original, the VALUE pass writes more data than the buffer was sized for, corrupting adjacent heap memory with fully attacker-controlled content. ❗️Information leak: when the clobbered capture is smaller, the buffer is oversized, and the response leaks uninitialized heap bytes — including libc and heap pointers sufficient to defeat ASLR in a single unauthenticated GET request.
Post summary
CVE‑2026‑42533 is a newly disclosed pre‑authentication remote code execution flaw in nginx’s script engine, involving a heap buffer overflow and information leak; no patch, PoC, or active exploitation details are provided.
76342609331.0K
72.7K followersView on X
7h3h4ckv157@7h3h4ckv15788d
Disclosure
Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533 Credit/Author: Cyberstan His blog: https://cyberstan.co.uk/nginx-rce/ https://t.co/2ahfucUJ57
Post summary
The post announces a new nginx RCE vulnerability (CVE‑2026‑42533) with technical details but does not provide proof‑of‑concept, exploit code, or patch information.
34521888564.7K
56.8K followersView on X
ThreatWire@ThreatWire_80d
PoC
🚨 A public PoC has been released for CVE-2026-42533 affecting NGINX Plus and NGINX Open Source. The vulnerability can trigger a heap buffer overflow, leading to worker crashes and potentially RCE under specific conditions. 🔗 https://github.com/imbas007/cve-2026-42533 #NGINX #RCE #CVE
Post summary
The CVE‑2026‑42533 flaw in NGINX allows a heap buffer overflow that can lead to crashes and possible remote code execution, and a publicly available PoC has been published on GitHub.
03811326818.4K
1.5K followersView on X
mufeed vh@mufeedvh80d
Disclosure
Introducing ENDGINX - 5 CVEs in NGINX with open models. We let loose GLM 5.1 and 5.2 by @Zai_org on the NGINX codebase. The work resulted in six fixed vulnerabilities across five CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, and CVE-2026-42533. First of our open-model vulnerability research series. https://winfunc.com/research/endginx
Post summary
The post announces five newly discovered CVEs in NGINX identified via open‑model research, indicating the vulnerabilities have been fixed, but provides no further technical or exploit‑related details.
130192549.2K
4.8K followersView on X
The Hacker News@TheHackersNews86d
General
Did you know CVE-2026-42533 was independently reported to F5 by more than a dozen researchers? The NGINX flaw dates back to version 0.9.6 in 2011. But exposure depends on a specific regex-based map configuration, not just running an affected build.
Post summary
The post notes that CVE-2026-42533 was reported to F5, cites the vulnerable NGINX version and configuration dependency, but offers no evidence of exploitation or mitigation.
52001062942.6K
2.3M followersView on X
Ryo Suzuki@suzryo87d
PoC
Nginxの脆弱性、影響把握するため検証してみた。なるべく早めのバージョンアップが良さそうです。 2026年7月報告のnginx脆弱性（CVE-2026-42533）をDockerで再現してみた https://dev.classmethod.jp/articles/cve-2026-42533-nginx-rce-docker-repro/ #DevelopersIO
Post summary
The author has reproduced CVE-2026-42533 in Docker and recommends upgrading nginx as soon as possible.
0221835210.1K
1.0K followersView on X
Vivek | Cybersecurity@VivekIntel87d
Disclosure
CVE-2026-42533: Critical NGINX Bug Could Turn HTTP Requests Into Server Takeovers https://securityaffairs.com/195674/hacking/cve-2026-42533-critical-nginx-bug-could-turn-http-requests-into-server-takeovers.html
Post summary
The text announces a critical NGINX vulnerability (CVE-2026-42533) that could let attackers transform HTTP requests into server takeovers, but it does not provide PoC, exploit code, or patch information.
09058213.7K
18.1K followersView on X
FOFA@fofabot78d
Disclosure
⚠️⚠️ CVE-2026-42533 (CVSS 9.2): Critical heap overflow in NGINX via map regex capture clobbering — pre-auth RCE, ASLR bypass, 13 call sites. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJOR0lOWCI= 🎯578.8M+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="NGINX" 🔖Refer: https://unsafe.sh/go-429657.html #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The tweet announces CVE‑2026‑42533, a critical heap overflow in NGINX that allows pre‑authentication remote code execution and ASLR bypass, providing technical details but no patch or proof‑of‑concept information.
017043163.4K
14.8K followersView on X
yousukezan@yousukezan87d
PoC
2026年7月報告のnginx脆弱性（CVE-2026-42533）をDockerで再現してみた https://dev.classmethod.jp/articles/cve-2026-42533-nginx-rce-docker-repro/ #DevelopersIO
Post summary
The post reports that the author reproduced the CVE‑2026‑42533 nginx RCE vulnerability using Docker and shared a link to a detailed article demonstrating the exploit.
07131203.6K
14.9K followersView on X
elhacker.NET@elhackernet87d
Patch
Grave vulnerabilidad en F5 NGINX podría provocar caídas del sistema y permitir la ejecución remota de código F5 ha corregido una vulnerabilidad crítica (CVE-2026-42533) en nginx que permite a atacantes remotos provocar un desbordamiento de búfer https://blog.elhacker.net/2026/07/grave-vulnerabilidad-en-f5-nginx-podria.html
Post summary
F5 has released a patch for CVE-2026-42533, a critical buffer overflow in nginx that could allow remote code execution.
09034104.2K
141.8K followersView on X
Zhenpeng (Leo) Lin@Markak_82d
PoC
RCE implementation: https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main CVE-2026-42533 security advisory: https://my.f5.com/manage/s/article/K000162097 CVE-2026-42530 security advisory: https://my.f5.com/manage/s/article/K000161616
Post summary
A proof‑of‑concept RCE implementation was published on GitHub, with links to F5 advisories for CVE‑2026‑42533 and CVE‑2026‑42530; the post does not mention active exploitation, patches, or technical details.
03016172.0K
3.6K followersView on X
dbugs@ptdbugs80d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-42533 PT ID: PT-2026-60178 Vendor: F5 Product: NGINX Plus Description: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Links: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-60178 • https://github.com/imbas007/cve-2026-42533 • https://cyberstan.co.uk/nginx-rce/ #dbugs_vuln
Post summary
A PoC/exploit for CVE-2026-42533 has been released, demonstrating a heap buffer overflow that can lead to restart or, with ASLR disabled, code execution. The post offers technical details and public code, yet no evidence of active exploitation is cited.
0502371.7K
3.5K followersView on X
xer0dayz@xer0dayz70d
Exploit
CVE-2026-42533: critical nginx heap overflow via the map directive, with public ASLR-defeating exploit code. Get the Nuclei detection template and scan with Sn1per. https://sn1persecurity.com/wordpress/cve-2026-42533-nginx-map-heap-overflow-detection-with-sn1per/ #CVE-2026-42533 #bugbounty #netsec #infosec #offsec #redteam #EASM #infosecurity
Post summary
A public exploit and detection template exist for CVE‑2026‑42533, an nginx heap overflow through the map directive, providing attackers with an ASLR‑breaking payload.
0601831.3K
8.4K followersView on X
The CyberSec Guru@thecybersecguru87d
Disclosure
🚨 15 years. Millions of servers. One hidden bug. CVE-2026-42533 is a critical NGINX heap buffer overflow lurking since 2011 that can crash worker processes and, under specific conditions, may enable Remote Code Execution (RCE) via specially crafted HTTP requests. Attackers don't just target software versions. They target vulnerable configurations. Upgrade now. 🔥 ✅ Deep technical breakdown: • Why the bug survived for 15 years • Heap buffer overflow explained • LEN vs VALUE script engine flaw • PCRE capture overwrite • Vulnerable nginx configurations • Affected versions • Patch analysis • Mitigations • RCE conditions 📖 Read the full analysis: https://thecybersecguru.com/news/cve-2026-42533-nginx-rce-vulnerability/
Post summary
The post announces the discovery of CVE‑2026‑42533, a long‑existing NGINX heap buffer overflow that can potentially lead to RCE, and provides a deep technical breakdown and mitigation guidance.
03015513.1K
1.5K followersView on X
yousukezan@yousukezan91d
Patch
F5は、NGINX PlusとNGINX Open Sourceに存在する3件のメモリ安全性の脆弱性を修正した。最も深刻なCVE-2026-42533では、特定条件下で細工したHTTPリクエストによりワーカープロセスでヒープバッファオーバーフローが発生する。 CVE-2026-42533は、mapディレクティブで正規表現を使う構成で発生する。再起動を招くが、ASLRが無効または回避された環境ではコード実行につながる可能性がある。CVE-2026-60005はngx_http_slice_moduleの未初期化メモリ参照で、情報漏えいや再起動を引き起こす。CVE-2026-56434は、SSIとproxy_pass、proxy_buffering offを組み合わせ、上流応答を中間者が操作するとuse-after-freeが発生する。影響はNGINX Open Source 1.31.2と1.30.0～1.30.3、NGINX Plusの一部に及ぶ。修正版はOpen Source 1.31.3／1.30.4、Plus 37.0.3.1／R36 P7である。悪用や概念実証は確認されていない。 https://securityonline.info/nginx-code-execution-cve-2026-42533/
Post summary
The post announces the patching of three memory-safety vulnerabilities in NGINX, provides technical details and affected versions, but does not confirm any PoC or active exploitation.
0501241.9K
14.9K followersView on X
Chris Titus Tech@christitustech85d
Patch
Critical NGINX flaw CVE-2026-42533 lets unauthenticated attackers crash workers and may enable remote code execution on specific configs. Upgrade immediately to NGINX 1.30.4 or 1.31.3. https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html
Post summary
CVE‑2026‑42533 is a critical NGINX flaw that can crash workers and may allow RCE; users are urged to upgrade immediately to NGINX 1.30.4 or 1.31.3.
1101711.8K
27.9K followersView on X

CPE platform detail14 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

14 of 14 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	f5	nginx_gateway_fabric	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_ingress_controller	4.0.0	-	-
App	f5	nginx_ingress_controller	4.0.1	-	-
App	f5	nginx_plus	-	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	waf	-	nginx	-

Explore more

Back to dashboard f5 CVEs nginx_gateway_fabric vulnerabilities

What researchers are saying

CVE-2026-42533

Zhenpeng (Leo) Lin[verified]@Markak_Exploit

A PoC/exploit for NGINX CVE-2026-42533 is open-sourced, highlighting powerful RCE with info leak and ASLR bypass; no evidence of active exploitation or patch status is provided.

Aikido Community Japan[verified]@AikidoCommJPPatch

The post announces critical CVE-2026-42533 in NGINX, supplies patch recommendations, and previews a PoC but does not provide exploit code or report active attacks.

Cyber Security News[verified]@The_Cyber_NewsDisclosure

CVE‑2026‑42533 is a newly disclosed pre‑authentication remote code execution flaw in nginx’s script engine, involving a heap buffer overflow and information leak; no patch, PoC, or active exploitation details are provided.

7h3h4ckv157[verified]@7h3h4ckv157Disclosure

The post announces a new nginx RCE vulnerability (CVE‑2026‑42533) with technical details but does not provide proof‑of‑concept, exploit code, or patch information.

ThreatWire[verified]@ThreatWire_PoC

The CVE‑2026‑42533 flaw in NGINX allows a heap buffer overflow that can lead to crashes and possible remote code execution, and a publicly available PoC has been published on GitHub.

mufeed vh[verified]@mufeedvhDisclosure

The post announces five newly discovered CVEs in NGINX identified via open‑model research, indicating the vulnerabilities have been fixed, but provides no further technical or exploit‑related details.

Ryo Suzuki[verified]@suzryoPoC

The author has reproduced CVE-2026-42533 in Docker and recommends upgrading nginx as soon as possible.

Vivek | Cybersecurity[verified]@VivekIntelDisclosure

The text announces a critical NGINX vulnerability (CVE-2026-42533) that could let attackers transform HTTP requests into server takeovers, but it does not provide PoC, exploit code, or patch information.