A 15-year-old flaw in nginx’s map directive is no longer theoretical. Researcher Stan Shaw demonstrated that a single unauthenticated GET request leaks heap pointers directly from the server — defeating ASLR without any preconditions — and a follow-up request achieves controlled code execution. Lab result: 10 out of 10. F5 patched it July 15 in nginx 1.30.4 and 1.31.3. A full public exploit is expected around August 1. You have about a week.
What the Bug Actually Is
nginx’s script engine uses a two-pass model: a LEN pass measures how large the output buffer needs to be, then a VALUE pass writes into it. The problem is that a regex-based map directive, when it fires, overwrites the shared capture array ($1, $2, etc.) between those two passes. If the VALUE pass produces more bytes than the LEN pass measured, the write runs off the end of the heap buffer.
That is the capture-clobbering bug. It has been sitting in every nginx version since March 2011, when the map directive gained regex support. F5 rates it CVSS v3.1: 8.1. Independent researchers rate it CVSS v4.0: 9.2. The gap reflects the ASLR bypass.
Why “Possible RCE” Really Means “Practical RCE”
F5’s advisory says RCE requires ASLR to be disabled or bypassed, framing it as a high bar. Shaw’s research removes that bar entirely. The overflowing buffer exposes uninitialized heap data — including libc and heap pointer values — in the HTTP response. You do not need to brute-force ASLR. The server hands you the addresses. One GET to leak, one request to exploit. Shaw’s lab testing on Ubuntu 24.04 with full ASLR enabled: successful exploitation every time.
This is not a “patch when convenient” situation. The Hacker News and multiple security vendors have covered the scanner that is already public. The full working exploit is expected within roughly two weeks of the July 15 disclosure — putting it around August 1.
Is Your nginx Actually Vulnerable?
Not every nginx server is exposed. The heap overflow only triggers under a specific configuration: a map directive using a regex pattern, where the map’s output variable and numbered capture variables ($1 or $2) appear together in the same string expression. If your configs don’t use this pattern, you are not in the exploitable path — though you should still patch, because the same release fixes two other vulnerabilities (CVE-2026-60005 and CVE-2026-56434).
Shaw also released a read-only static config scanner on GitHub that flags vulnerable directive orderings without touching your running server. Run it before assuming you are or are not exposed.
# Check your nginx version
nginx -v
# Clone and run the config scanner
git clone https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner
cd CVE-2026-42533-Config-Scanner
python3 scanner.py /etc/nginx/nginx.confHow to Patch
Upgrade to one of the following patched versions:
- nginx Open Source (stable): 1.30.4
- nginx Open Source (mainline): 1.31.3
- NGINX Plus: 37.0.3.1 or R36 P7
- NGINX Gateway Fabric: 2.6.7
- NGINX Ingress Controller (F5): 5.5.3 or 2026-lts-r4
On Ubuntu/Debian:
sudo apt update && sudo apt install nginx
nginx -v # Confirm 1.30.4 or higherThe Kubernetes Wrinkle
If you are running the upstream kubernetes/ingress-nginx controller, there is no patch coming. The project retired in March 2026 at v1.15.1, and nginx is compiled directly into the controller binary — not a swappable dependency. HeroDevs confirms no patch release is planned for the retired ingress-nginx project. Migrate to F5’s NGINX Ingress Controller (patched in v5.5.3) or another maintained option before August 1.
Temporary Mitigation If You Cannot Patch
If an immediate upgrade is blocked by your change management process, switch from numbered capture variables to named captures in your map blocks. Named captures break the clobbering chain:
# Vulnerable — numbered capture in map output
map $uri $mapped_var {
~^/api/(.+)$ "result-$1";
}
# Safe — named capture breaks the clobbering chain
map $uri $mapped_var {
~^/api/(?P<id>.+)$ "result-${id}";
}This is a stopgap. Patch anyway.
The Clock
The public scanner is already live. The full exploit is expected around August 1. Automated exploit kits typically follow within days of a working public PoC. nginx runs on 33% of the web. If you are in that 33% and running any version from the past 15 years, the question is not whether to patch — it is whether you will patch before or after the scanner finds you.
