type: cve · created: 2026-07-20 · updated: 2026-07-20 · tags: [cve, zero-day, web-server, buffer-overflow] · confidence: high · severity: not-rated · affected_sectors: [technology] · au_impact: true
CVE-2026-42533 — NGINX Heap Buffer Overflow
A critical heap buffer overflow vulnerability in nginx (CVE-2026-42533) allows unauthenticated attackers to trigger denial of service (DoS) and potentially remote code execution (RCE) via crafted HTTP requests.
Details
| Field | Value |
|---|---|
| CVE | CVE-2026-42533 |
| Type | Heap buffer overflow |
| Impact | DoS / potential RCE |
| CVSS | Pending (rated critical by F5) |
| Auth required | None (unauthenticated) |
| Attack vector | Crafted HTTP requests |
| Configuration trigger | Specific regex-map configuration in nginx script engine |
| Disclosure | July 15, 2026 |
Affected Versions
| Product | Fixed Version |
|---|---|
| nginx (open source) | 1.30.4 / 1.31.3 |
| NGINX Plus | 37.0.3.1 |
Mitigation
- Upgrade immediately to the patched versions listed above
- ASLR must be enabled as a defense-in-depth measure — where ASLR is disabled or can be bypassed, F5 warns of potential RCE
- Apply strict HTTP input filtering as a compensating control
Significance
NGINX powers a significant portion of the internet's web infrastructure, including reverse proxies, load balancers, and API gateways. A critical unauthenticated overflow in the core server is a high-priority patching action for any organisation running nginx. (raw/digests/Cyber-Digest-2026-07-20)
Australian Significance
NGINX is widely used across Australian government, finance, and enterprise infrastructure. Organisations should prioritise patching, particularly for internet-facing deployments where unauthenticated exploitation is possible.
Related Pages
- Rogueplanet Cve 2026 50656 — Critical Microsoft Defender race condition (same period)
- Ghostlock Cve 2026 43499 — Critical Linux kernel heap flaw (same period)
- Wp2Shell — Critical WordPress RCE chain (same period)