F5 fixes critical nginx vulnerability CVE-2026-42533

Security Affairs reports that F5 has released patches for a critical nginx vulnerability, identified as CVE-2026-42533, which poses a significant risk of server crashes and potential remote code execution.

The vulnerability, with a CVSS score of 9.2, allows an unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests. This flaw affects both NGINX Plus and Open Source versions from 0.9.6 through 1.31.2 when specific regex-based map configurations are utilized. While the primary impact is denial of service, researchers suggest that under certain conditions, such as disabled ASLR, remote code execution might be possible. The issue is limited to the data plane.

F5 has addressed the vulnerability in NGINX 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1. A temporary workaround involves modifying affected map configurations to use named captures instead of numbered ones, though this does not offer complete protection. The vulnerability was discovered by Mufeed VH and Maxim Dounin, with security researcher Stan Shaw highlighting its potential for remote code execution and releasing a scanner to identify vulnerable configurations.

Source: Security Affairs