---
id: CVE-2026-42533
title: "A vulnerability exists in NGINX Plus and NGINX Open Source when a map\_directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable"
summary: "A vulnerability exists in NGINX Plus and NGINX Open Source when a map\_directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same …"
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
vendor: f5
product: nginx_gateway_fabric
affected:
  - 'nginx_gateway_fabric >= 1.3.0, <= 1.6.2'
  - 'nginx_gateway_fabric >= 2.0.0, < 2.6.7'
  - 'nginx_ingress_controller >= 3.5.0, <= 3.7.2'
  - 'nginx_ingress_controller >= 5.0.0, < 5.5.3'
  - 'nginx_ingress_controller >= 2026-lts-r1, < 2026-lts-r4'
  - nginx_ingress_controller = 4.0.0
  - nginx_ingress_controller = 4.0.1
  - 'nginx_plus >= 37.0.0.1, < 37.0.3.1'
  - 'nginx_plus >= r33, < r36'
  - nginx_plus = r36
  - 'waf >= 4.11.0, <= 4.16.0'
  - 'waf >= 5.2.0, <= 5.8.0'
  - 'waf >= 5.9.0, < 5.13.4'
patched:
  - nginx_gateway_fabric 2.6.7
  - nginx_ingress_controller 2026-lts-r4
  - nginx_plus r36
  - waf 5.13.4
published: '2026-07-15'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:17:43.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42533'
references:
  - url: 'https://my.f5.com/manage/s/article/K000162097'
    label: f5sirt@f5.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-29T03:55:25.631530Z'
epss: 0.06296
epssPercentile: 0.93633
exploits:
  github: 12
  githubRepos:
    - 'https://github.com/imbas007/CVE-2026-42533'
    - 'https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner'
    - 'https://github.com/Daniyal48/ghostlock-vagrant-box'
  checkedAt: '2026-11-06T17:10:09.166Z'
ingestedAt: '2026-11-05T06:38:03.622Z'
---

## Overview

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.




 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Affected

- `nginx_gateway_fabric >= 1.3.0, <= 1.6.2`
- `nginx_gateway_fabric >= 2.0.0, < 2.6.7`
- `nginx_ingress_controller >= 3.5.0, <= 3.7.2`
- `nginx_ingress_controller >= 5.0.0, < 5.5.3`
- `nginx_ingress_controller >= 2026-lts-r1, < 2026-lts-r4`
- `nginx_ingress_controller = 4.0.0`
- `nginx_ingress_controller = 4.0.1`
- `nginx_plus >= 37.0.0.1, < 37.0.3.1`
- `nginx_plus >= r33, < r36`
- `nginx_plus = r36`
- `waf >= 4.11.0, <= 4.16.0`
- `waf >= 5.2.0, <= 5.8.0`
- `waf >= 5.9.0, < 5.13.4`

## Remediation

Upgrade past the affected range:

- `nginx_gateway_fabric 2.6.7`
- `nginx_ingress_controller 2026-lts-r4`
- `nginx_plus r36`
- `waf 5.13.4`