CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak

CVE-2026-42533 is a critical vulnerability affecting multiple NGINX products, including NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and NGINX Gateway Fabric. The flaw is technically classified as an improper restriction of operations within the bounds of a memory buffer (CWE-119), which can manifest as a heap-based buffer overflow (CWE-122) or an information disclosure vulnerability.

The vulnerability is situated within NGINX's internal evaluation engine when handling complex variables. Specifically, the flaw is exposed when a configuration chains regular expression-based map directives with numbered capture groups. Because of the broad deployment of NGINX as an edge reverse proxy, this vulnerability represents a significant attack surface for external unauthenticated threat actors.

Under specific conditions, an unauthenticated remote attacker can exploit this weakness by transmitting crafted HTTP requests. This can lead to two distinct primitives: a heap information leak that completely circumvents Address Space Layout Randomization (ASLR), and a heap-based buffer overflow that enables arbitrary remote code execution (RCE) with the privileges of the NGINX worker process.

The root cause of CVE-2026-42533 resides in NGINX's script and complex-value evaluation engine. NGINX utilizes a two-pass architecture to evaluate variables containing string compositions. The first pass, known as the measurement or LEN pass, iterates through active tokens to calculate the aggregate length of the final evaluated string. This calculated length determines the size of the memory block allocated from the connection or request pool.

The second pass, designated as the value or execution pass, iterates through the tokens again to evaluate their contents and copy them into the newly allocated buffer. This architecture relies on the absolute stability of the variables' sizes between both passes. If a variable's size changes between the measurement pass and the execution pass, the buffer allocation size will no longer align with the actual data written.

The instability occurs due to a lack of state isolation for the PCRE regex capture groups. Numbered capture variables ($1 through $9) are stored globally within the per-request captures structure. When a regular expression-based map directive is evaluated, its execution runs a fresh PCRE match that overwrites the shared capture state. If this evaluation occurs between the measurement and copy phases of a numbered capture variable in a complex-value sink, the engine references mismatched sizes, leading to a buffer overflow or an information leak.

An analysis of the underlying code path demonstrates how the lack of serialization of r->captures permits the state clobbering. In vulnerable versions, the evaluation of variables is handled by handlers like ngx_http_script_copy_capture_code. This handler relies directly on the state of the shared captures array without verifying if intermediate evaluations have modified the active capture indexes.

/* Vulnerable execution path in ngx_http_script_copy_capture_code */
void
ngx_http_script_copy_capture_code(ngx_http_script_engine_t *e)
{
    size_t                         len;
    u_char                        *p;
    ngx_http_script_capture_code_t *code;
 
    code = (ngx_http_script_capture_code_t *) e->ip;
    e->ip += sizeof(ngx_http_script_capture_code_t);
 
    /* Directly references the shared captures array */
    n = code->n;
    if (n < e->request->ncaptures) {
        len = e->request->captures[n + 1] - e->request->captures[n];
        e->pos = ngx_cpymem(e->pos, &e->request->captures_data[e->request->captures[n]], len);
    }
}

The official patch addresses this issue by introducing capture state preservation. When NGINX enters a context where a nested evaluation or a map lookup is triggered, the engine now serializes the active r->captures state to a temporary storage structure. Once the sub-evaluation or map evaluation is completed, the original capture state is restored, preventing any modification to the capture offsets during the execution phase.

/* Patched execution path incorporating capture state save and restore */
void
ngx_http_script_copy_capture_code_patched(ngx_http_script_engine_t *e)
{
    /* The engine now maintains a saved state to prevent clobbering */
    ngx_http_script_save_captures(e);
    
    /* Evaluation is performed safely using isolated state structures */
    ngx_http_script_restore_captures(e);
}

Exploitation of CVE-2026-42533 requires a multi-stage process to bypass modern exploit mitigations like Address Space Layout Randomization (ASLR). First, the attacker triggers Primitive A to perform a heap information disclosure. By crafting a request where the initial capture size measured in the LEN pass is large, and the subsequent clobbered capture size in the VALUE pass is small, NGINX writes a small amount of data but returns the entire large pre-allocated buffer. This uninitialized buffer contains residue pointers from the glibc unsorted bin, disclosing the base addresses of libc and the heap.

Second, the attacker performs heap grooming by establishing multiple concurrent keep-alive connections. This grooms the heap to place a target pool cleanup structure (ngx_pool_cleanup_t) adjacent to the buffer allocated for the overflow request. The attacker then terminates a connection to create a specific free slot in the heap layout.

Finally, the attacker triggers Primitive B by sending a request where the clobbered capture size is larger than the measured buffer size. The resulting out-of-bounds write overflows into the adjacent connection pool structure, overwriting the cleanup handler pointer with the address of system() in libc. The cleanup data pointer is configured to point to an attacker-controlled command string, which executes when the connection is closed and the pool is destroyed.

The security impact of CVE-2026-42533 is exceptionally high, particularly in enterprise deployments where NGINX serves as the primary ingress point. Successful exploitation grants unauthenticated remote code execution with the privileges of the NGINX worker process. Because the worker process typically runs under a dedicated, low-privilege user account (such as nginx or www-data), direct system-level compromise is restricted to that user's boundaries unless coupled with a local privilege escalation vulnerability.

However, gaining code execution within the NGINX worker process provides immediate access to sensitive materials. Attackers can read TLS private keys, intercept in-transit user credentials, access internal databases, and pivot to other services within the internal network. The vulnerability possesses a CVSS v4.0 score of 9.2, highlighting its severity in exposed environments.

Furthermore, because the exploit operates entirely in-memory within the NGINX heap, traditional file-based endpoint detection and response (EDR) solutions may fail to detect the initial compromise. The absence of disk-based artifacts means that security teams must rely on network-level telemetry, memory inspection, and anomaly detection in worker process behaviors to identify active exploitation attempts.

The most effective remediation for CVE-2026-42533 is to update NGINX to a patched version immediately. Administrators should deploy NGINX Open Source 1.30.4 (Stable), 1.31.3 (Mainline), or NGINX Plus R36 P7 / 37.0.3.1. These updates modify the evaluation engine to guarantee that capture state contexts are preserved and restored, eliminating the underlying race-like condition.

If immediate patching is unfeasible, a robust configuration workaround exists. The vulnerability relies specifically on the overwrite of numbered capture variables ($1 through $9). Administrators can mitigate the threat by rewriting regular expression map directives to use named capture groups (e.g., (?<val>...) instead of (...)). Named capture variables are evaluated via distinct structures that do not rely on or modify the global r->captures state.

# Vulnerable Pattern
map $http_input $target {
    "~^(.+)$" $1;
}
 
# Secure Mitigated Pattern
map $http_input $target {
    "~^(?<secure_val>.+)$" $secure_val;
}

Additionally, security teams should implement monitoring for NGINX worker crashes. Repeated crashes resulting in worker processes exiting on signal 6 (SIGABRT) or signal 11 (SIGSEGV) can indicate failed exploitation attempts or heap corruption diagnostics.