Critical NGINX Buffer Overflow (CVE-2022-XXXX) Lets Attackers Run Code

Key Takeaways

• A critical heap buffer overflow (CVE-2026-42533) has been identified in NGINX Plus and NGINX Open Source.
• The vulnerability allows unauthenticated attackers to crash worker processes and potentially achieve remote code execution.
• Affected configurations include those using regex-based map directives or non-cacheable variables in string expressions, particularly with the Stream module’s ssl_preread feature.
• F5 released a security advisory on July 15, 2026, and patches are available.

Critical NGINX Flaw Exposes Servers to Remote Code Execution

A significant heap buffer overflow vulnerability, tracked as CVE-2026-42533, has been discovered in both NGINX Plus and NGINX Open Source. This high-severity flaw could enable unauthenticated attackers to cause worker processes to crash and, under specific circumstances, execute arbitrary code on affected systems.

Understanding the Vulnerability

The vulnerability primarily impacts NGINX deployments that utilize regex-based map directives or incorporate non-cacheable variables within string expressions. Its danger is significantly amplified when the Stream module’s ssl_preread feature processes specially crafted TLS traffic prior to any authentication checks.

According to analysis provided by researcher Zhenpeng (Leo) Lin, the flaw manifests when a map directive employs regex matching, and a string expression references the map’s regex capture variables before the map’s output variable is evaluated. A similar condition can arise if a non-cacheable variable is used within a string expression under certain configurations. An attacker capable of sending malicious HTTP or TLS requests can trigger a heap buffer overflow in the NGINX worker process, leading to a restart of the process.

On systems where Address Space Layout Randomization (ASLR) is disabled, or where an attacker successfully bypasses ASLR, this overflow can be escalated to achieve full remote code execution.

Technical Deep Dive into the Flaw

The core of this vulnerability resides within NGINX’s internal script engine, which processes “complex values” in a two-stage evaluation. The initial pass calculates the total required length for the result, while the subsequent pass copies the data into a heap buffer sized according to the first calculation. The issue emerges when a regex-based variable, such as one generated by a map directive, is evaluated between these two passes. This intermediate evaluation can modify the global capture state. Consequently, during the second pass, more data is copied than the allocated buffer can hold, resulting in a write past the end of the buffer.

In the context of the Stream module, the ssl_preread function extracts TLS handshake fields, including the Server Name Indication (SNI), into variables frequently used in complex values. Crucially, this extraction occurs before TLS termination, meaning the attack surface is exposed to unauthenticated clients.

A typical exploit scenario involves an attacker sending a TLS ClientHello message with a meticulously crafted SNI to a stream listener configured with ssl_preread enabled and a setup that evaluates regex captures within a complex value. The initial length calculation underestimates the final size, and after the capture state is altered, the copy operation overflows the heap. Security researchers have noted that this bug can provide both information-leak and out-of-bounds write primitives, which, when combined, facilitate ASLR bypass and reliable exploitation on vulnerable NGINX builds.

Discovery and Disclosure

F5 officially published its security advisory regarding CVE-2026-42533 on July 25, 2026. Researcher Zhenpeng (Leo) Lin and the team at Depth First Labs independently reported finding the issue through their internal systems. They also identified a separate flaw in NGINX’s HTTP/3 QPACK handling (CVE-2026-42530) around the same time. Lin posted about the vulnerability on X, stating, “Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!).” The post included a screenshot of their proof-of-concept, viewable at pic.twitter.com/MBICw0z49e.

The simultaneous discovery of CVE-2026-42533 by multiple groups highlights the widespread use of the affected code paths and the critical nature of this vulnerability.

What You Should Do

• Patch Immediately: Organizations running NGINX Plus or NGINX Open Source with stream blocks, ssl_preread, or regex-based maps should prioritize applying available patches from F5/NGINX.
• Limit Exposure: Until updates are fully deployed, reduce the exposure of stream listeners to untrusted networks.
• Review Configurations: Avoid referencing regex captures in complex values before map outputs are fully evaluated in your NGINX configurations.
• Maintain ASLR: Ensure that Address Space Layout Randomization (ASLR) remains enabled on all NGINX host systems to mitigate the risk of remote code execution.
• Monitor and Validate: Administrators should closely monitor official F5 and NGINX channels for fixed releases, apply them promptly, and then validate that worker processes no longer crash when processing malformed ClientHello or HTTP traffic.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.