NGINX – Heap Buffer Overflow (CVE-2026-42533)

Scope: NGINX Plus and NGINX Open Source (Configurations utilizing regex-based map directives, non-cacheable variables, or the Stream ssl_preread module)

Severity: High

A high-severity heap buffer overflow vulnerability exists in NGINX Plus and NGINX Open Source due to improper memory management when processing specific string expressions. The flaw is triggered in configurations that rely on regex-based map directives or non-cacheable variables within string expressions. The risk is significantly amplified when the Stream module’s ssl_preread feature is enabled, as it processes incoming, unauthenticated TLS traffic prior to handshake completion. An unauthenticated remote attacker can exploit this vulnerability by transmitting maliciously crafted HTTP or TLS requests, triggering a heap overflow in the NGINX worker process. Successful exploitation forces the worker process to crash (creating a denial-of-service loop) and, under certain memory conditions, permits the execution of arbitrary code (RCE) on the underlying host system. Because a Proof of Concept (PoC) exploit has been publicly released, the likelihood of weaponization is imminent. Organizations must apply the latest security patches from F5/NGINX immediately. As a temporary defensive measure, administrators must audit nginx.conf files, eliminate untrusted regex-based map directives where possible, and strongly consider disabling the ssl_preread directive if it is not strictly required for current traffic routing architectures.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the NVD Record for CVE-2026-42533 and apply the necessary updates.