CRITICAL NGINX flaw CVE-2026-42533 allows remote code execution via crafted HTTP requests, affecting a broad range of versions and prompting an urgent patch release.
The vulnerability tracks as CVE-2026-42533 and carries a CVSS score of 9.2, reflecting a heap buffer overflow in the NGINX map directive that can be triggered by an unauthenticated attacker sending a specially crafted HTTP request. It impacts all NGINX releases from 0.9.6 up to 1.31.2, with the risk amplified when regex based map configurations are in use.
The flaw was reported by researchers Mufeed VH and Maxim Dounin, and F5 has issued an out of band security update addressing it. Patched builds include NGINX Plus 37.0.3.1 and NGINX Open Source 1.31.3 or the older 1.30.4 line. Security researchers have warned that the flaw could bypass ASLR protections, increasing the chance of reliable remote code execution.
F5 states there is no sign of active exploitation in the wild and no threat actors have been linked to the issue so far. However the high severity rating means successful abuse could lead to full server takeover, memory disclosure or denial of service, making it a priority for any perimeter facing NGINX deployment.
Defenders should prioritise applying the latest NGINX builds from the official repositories or directly from F5 for Plus customers. If immediate patching is not feasible, administrators can mitigate risk by disabling regex heavy map directives, tightening request size limits and deploying web application firewall rules that block anomalous patterns. Continuous monitoring of access logs for unexpected spikes in malformed requests is also advised.
Organisations are encouraged to maintain an accurate asset inventory, test updates in a staging environment before rollout and subscribe to F5 security advisories or the nginx.org CHANGES feed for future alerts. Staying current with patches remains the most effective defence against this class of memory safety flaws.