{"id":"CVE-2026-42533","title":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable","summary":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-122"],"vendor":"f5","product":"nginx_gateway_fabric","affected":["nginx_gateway_fabric >= 1.3.0, <= 1.6.2","nginx_gateway_fabric >= 2.0.0, < 2.6.7","nginx_ingress_controller >= 3.5.0, <= 3.7.2","nginx_ingress_controller >= 5.0.0, < 5.5.3","nginx_ingress_controller >= 2026-lts-r1, < 2026-lts-r4","nginx_ingress_controller = 4.0.0","nginx_ingress_controller = 4.0.1","nginx_plus >= 37.0.0.1, < 37.0.3.1","nginx_plus >= r33, < r36","nginx_plus = r36","waf >= 4.11.0, <= 4.16.0","waf >= 5.2.0, <= 5.8.0","waf >= 5.9.0, < 5.13.4"],"patched":["nginx_gateway_fabric 2.6.7","nginx_ingress_controller 2026-lts-r4","nginx_plus r36","waf 5.13.4"],"published":"2026-07-15","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:17:43.553","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42533","references":[{"url":"https://my.f5.com/manage/s/article/K000162097","label":"f5sirt@f5.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-07-29T03:55:25.631530Z"},"epss":0.06296,"epssPercentile":0.93633,"exploits":{"github":12,"githubRepos":["https://github.com/imbas007/CVE-2026-42533","https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner","https://github.com/Daniyal48/ghostlock-vagrant-box"],"checkedAt":"2026-11-06T17:10:09.166Z"},"ingestedAt":"2026-11-05T06:38:03.622Z","slug":"CVE-2026-42533","body":"## Overview\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n## Affected\n\n- `nginx_gateway_fabric >= 1.3.0, <= 1.6.2`\n- `nginx_gateway_fabric >= 2.0.0, < 2.6.7`\n- `nginx_ingress_controller >= 3.5.0, <= 3.7.2`\n- `nginx_ingress_controller >= 5.0.0, < 5.5.3`\n- `nginx_ingress_controller >= 2026-lts-r1, < 2026-lts-r4`\n- `nginx_ingress_controller = 4.0.0`\n- `nginx_ingress_controller = 4.0.1`\n- `nginx_plus >= 37.0.0.1, < 37.0.3.1`\n- `nginx_plus >= r33, < r36`\n- `nginx_plus = r36`\n- `waf >= 4.11.0, <= 4.16.0`\n- `waf >= 5.2.0, <= 5.8.0`\n- `waf >= 5.9.0, < 5.13.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nginx_gateway_fabric 2.6.7`\n- `nginx_ingress_controller 2026-lts-r4`\n- `nginx_plus r36`\n- `waf 5.13.4`","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":44.6,"likelihood":1.3,"exploitation":12,"ransomware":0},"changes":[]}