Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

NGINX Heap Overflow Flaw (CVE-2026-42533) Patches Released

Part of the CVE-2026-42533 story · since 16 Jul

Quiet for 13 weekslast report 28 Jul4 articles3 outlets
16 Jul · SecurityOnline first7 Sep25 Sep13 OctNowThis article4th of 4
  • Thu 16 Jul, 03:06 UTC. SecurityOnline, first report. F5 patches NGINX memory flaw enabling remote code execution.
  • Thu 16 Jul, 09:26 UTC. SecurityWeek, its first report on the story. F5 patches NGINX heap overflow bug CVE-2026-42533 in eight fixes.
  • Mon 20 Jul, 11:11 UTC. Security Affairs, its first report on the story. Critical NGINX Flaw CVE-2026-42533 Allows Remote Code Execution.
  • Tue 28 Jul, 15:50 UTC. SecurityOnline. NGINX Heap Overflow Flaw (CVE-2026-42533) Patches Released. This article, 4th of 4.

The content discusses CVE-2026-42533, a critical heap overflow vulnerability in F5's NGINX rated with a CVSS score of 9.2. This vulnerability allows unauthenticated attackers to corrupt worker memory and could lead to remote code execution (RCE) due to an ASLR bypass. It affects several versions of NGINX Plus and Open Source products. Although no confirmed exploitation has occurred, a proof-of-concept has been published.

The vulnerability can be exploited through crafted requests, specifically by manipulating regex-based maps. F5 released patches on July 15, 2026, and advises users to upgrade immediately to mitigate risks.

How the story developed

All 4 articles
Quiet for 13 weekslast report 28 Jul4 articles3 outlets

4 articles from 3 outlets since 16 Jul. Quiet since 28 Jul. This was the 4th report, 13 days after the first.

Now16 Jul182022242628First reportSecurityOnline · 16 Jul, 03:06This article4th of 4 · day 12Picked up againafter 4 days quiet
  • Thu 16 Jul, 03:06 UTC. SecurityOnline, first report. F5 patches NGINX memory flaw enabling remote code execution.
  • Thu 16 Jul, 09:26 UTC. SecurityWeek, its first report on the story. F5 patches NGINX heap overflow bug CVE-2026-42533 in eight fixes.
  • Mon 20 Jul, 11:11 UTC. Security Affairs, its first report on the story. Critical NGINX Flaw CVE-2026-42533 Allows Remote Code Execution.
  • Tue 28 Jul, 15:50 UTC. SecurityOnline. NGINX Heap Overflow Flaw (CVE-2026-42533) Patches Released. This article, 4th of 4.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Thu 16 JulDay 02
    1. F5 patches NGINX memory flaw enabling remote code execution03:06 · SecurityOnline · First report
    2. F5 patches NGINX heap overflow bug CVE-2026-42533 in eight fixes09:26 · SecurityWeek

  2. Quiet for 4 days

    Mon 20 JulDay 41
    1. Critical NGINX Flaw CVE-2026-42533 Allows Remote Code Execution11:11 · Security Affairs · Picked up again

  3. Quiet for 8 days

    Tue 28 JulDay 121
    1. NGINX Heap Overflow Flaw (CVE-2026-42533) Patches Released15:50 · SecurityOnline · Picked up again · This article, 4th of 4

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in