A 15-year-old heap overflow in nginx’s map directive went public on July 15 — and the real emergency isn’t the patch. It’s the Kubernetes ingress controller that will never receive one. CVE-2026-42533 (CVSS 9.2) affects every nginx build from version 0.9.6 through 1.31.2 when regex-based map directives are in use. F5 patched it in nginx 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1 on July 15. But the archived kubernetes/ingress-nginx — sitting inside roughly half of all Kubernetes clusters — ships nginx 1.27.1 and is permanently frozen. A public config scanner is already live. Researchers expect a working exploit in August.
What the Bug Actually Does
nginx’s script engine makes two passes over a request: one to measure the output buffer, one to write into it. When a map directive with a regex pattern sits between two references to a numbered capture variable ($1, $2), it clobbers the shared capture state between passes. The measurement and the write disagree on size, and you get a heap buffer overflow in the worker process.
The result: worker crashes (denial of service, guaranteed), and potential remote code execution where ASLR is disabled or bypassed. No authentication required — a specially crafted HTTP request is enough to trigger it. The bug traces back to nginx 0.9.6 from 2009. Fifteen years of production deployments.
Patch Now: The Version Table
| What you run | Target version |
|---|---|
| nginx stable | 1.30.4 |
| nginx mainline | 1.31.3 |
| NGINX Plus | R37.0.3.1 or R36 P7 |
| ingress-nginx (archived) | No patch — migrate |
One important note: CVE-2026-42533 only fires when your nginx config uses the map directive with regex captures. Not every nginx install does. Run the static config scanner to find out before you panic — it identifies vulnerable directive orderings without triggering anything. If you can’t patch immediately, switching from numbered captures ($1) to named captures ((?P<name>...)) in your map directives eliminates the side-effect. It’s not a substitute for patching, but it buys time.
The Kubernetes Problem Nobody Wants to Talk About
Here’s where it gets uncomfortable. The Kubernetes Steering and Security Response Committees announced in January 2026 that kubernetes/ingress-nginx is retired. No new releases, no security patches. The project is archived. And the version it ships — nginx 1.27.1 — is squarely in CVE-2026-42533’s blast radius.
Roughly half of cloud-native Kubernetes deployments run ingress-nginx. That’s not a niche exposure. If you’re among them, you have three realistic paths forward:
- F5’s OSS NGINX Ingress Controller — Apache 2.0 licensed, vendor-maintained by F5, and the closest drop-in replacement. Ships current nginx versions. Most ingress-nginx configs migrate with minimal changes.
- Kubernetes Gateway API — the official successor to Ingress (v1.4 is GA). More expressive routing, better role separation, supported by Traefik, Cilium, Istio, and Linkerd. Steeper migration effort, but where the ecosystem is heading.
- Traefik, HAProxy Ingress, or Kong — all actively maintained, all support both Ingress and Gateway API. Traefik in particular has an nginx annotation compatibility plugin that makes the switch considerably less painful.
The practical move for most teams: switch controllers now, migrate to Gateway API later. Don’t let perfect be the enemy of patched.
You Have Until August
No public exploit exists yet. No exploitation in the wild has been reported. But a public config scanner is already circulating, and security researchers have telegraphed that a working PoC is coming in August. That’s not a lot of runway.
CVE-2026-42533 is fixable in 10 minutes for teams running standard nginx. For teams running archived ingress-nginx, it’s the migration conversation they’ve been postponing since January. This bug — hidden in nginx’s map directive for 15 years — just handed them a deadline.
