Patch Released for NGINX Two-Pass Overflow That Could Enable Remote Code Execution
F5 issued fixes for a critical NGINX flaw (CVE-2026-42533) that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the script engine via a specific two-pass evaluation of regex-based maps, potentially causing a crash or remote code execution if ASLR is disabled. All versions up to 1.31.2 are affected; upgrade to nginx 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus 37.0.3.1. As a temporary mitigation, switch affected regex maps to named captures, though full remediation requires upgrading; exposure depends on configuration, not just version.