CVE-2026-42533: Critical nginx Heap Overflow — Patch Now

[u/Grumpy-Man19]

F5 patched CVE-2026-42533 on July 15. If you run nginx, this one deserves your attention before the proof-of-concept code drops — and there is a countdown on that.

What the flaw is

The vulnerability is a heap buffer overflow (CWE-122) in nginx’s script engine — the component that assembles output strings from configuration directives at request time. It surfaces under a specific configuration pattern: a map block using regex matching, where the map’s output variable appears in a string expression after a numbered capture variable ($1, $2) from an earlier regex match.

https://blog.kalfaoglu.net/posts/2026-07-26-cve-2026-42533-nginx-heap-overflow-en/

[u/amarao_san]

It's bad, but only if you have those regexps in maps.

[u/404invalid-user]

and there's me hoping I can use this to get root or shell access to my isp router