CVE-2026-42533: Heap Buffer Overflow in Nginx

CVE-2026-42533 identifies a heap buffer overflow vulnerability in Nginx Plus and Nginx Open Source. The flaw manifests when the map directive uses regex pattern matching and capture variables are referenced before the map output variable. An unauthenticated attacker can exploit it with crafted HTTP requests, potentially causing Nginx worker process crashes or, on systems without ASLR, remote code execution (RCE).

The vulnerability has a CVSS score of 8.1, classifying it as high severity. It was published by NVD on July 15, 2026. The impact is limited to the data plane (the web server itself), with no control plane exposure. Current signals on social media report post-patch issues on AlmaLinux 8, 9, and 10 (HTTP 500 errors encountered after applying the fix), suggesting that a patch has been distributed but with potential side effects. Currently, no public exploits are reported on GitHub repositories.

Priority defensive actions include: verifying the release of official patches from Nginx and your Linux distribution vendor; thoroughly testing the patch in non-production environments before deployment to exclude regressions; temporarily disabling regex-based map directives if not strictly necessary until patch stability is confirmed; monitoring Nginx worker processes for unexpected restarts. Consult official Nginx advisories and your distribution's changelog for the exact fix timing and compatibility.