NGINX CVE-2026-42533: A Critical 9.2-Severity Flaw Affects Every Version Since 2011 — Here's How to Fix It

F5 dropped an out-of-band security advisory on Wednesday, and if you’re running NGINX — which, statistically, about a third of the internet is — you need to pay attention. CVE-2026-42533 is a heap buffer overflow in NGINX’s map module with a CVSS score of 9.2, and it affects every single version of NGINX released since 2011. That’s 15 years of deployments, from the Raspberry Pi in your closet to the load balancer in front of your production cluster. The vulnerability was reported to F5 through responsible disclosure, but now that the advisory and patch are public, attackers can reverse-engineer the fix to build working exploits. The clock is already running.

Here’s what you need to know, how to check if you’re affected, and exactly what to run to fix it.

What CVE-2026-42533 actually does

The vulnerability lives in NGINX’s map directive, specifically in how it handles regular expressions during HTTP request processing. When NGINX processes a crafted HTTP request that triggers regex matching through a map block, a heap buffer overflow occurs in the worker process.

Here’s what that means in practical terms. The map directive is one of NGINX’s most commonly used features — it lets you create variables whose values depend on other variables. A typical use case: mapping incoming hostnames to backend servers, or extracting API versions from URIs. The directive supports regular expressions, and that’s where the bug is. When a regex pattern is evaluated against a specifically crafted input string, the buffer allocated for the result is too small, and adjacent heap memory gets overwritten.

The immediate consequence is that the worker process crashes or restarts. A single malicious request can take down a worker. A stream of them — which an attacker can automate trivially — keeps workers in a continuous crash-restart cycle. Your site stays up only as long as you have workers that haven’t been hit, and once they all cycle through crashes, you’re effectively down.

The scarier scenario: F5’s advisory notes that if Address Space Layout Randomization (ASLR) is disabled on the host system, or if an attacker can bypass it through a separate information leak, this heap overflow may allow remote code execution in the context of the NGINX worker process. Most modern Linux distributions run with ASLR enabled by default, but containerized environments, embedded systems, and older configurations sometimes disable it for debugging or compatibility reasons. If you’re not sure whether ASLR is active:

cat /proc/sys/kernel/randomize_va_space

A value of 2 means full ASLR. 0 or 1 means you should fix that immediately, CVE-2026-42533 or not.

The affected range is staggering and worth sitting with for a moment: every NGINX version from 0.9.6 through 1.31.2. The map directive gained regex support in version 0.9.6, released in 2011. That means this vulnerability has been present in the NGINX codebase for 15 years, across every major release, every patch version, every distribution package, and every Docker image built from an official source during that entire period. If you deployed NGINX at any point in the last decade and a half and haven’t explicitly upgraded in the last 72 hours, you’re running a vulnerable version.

Versions affected: NGINX Open Source 0.9.6 through 1.31.2, and NGINX Plus versions prior to 37.0.3.1.

Check if you’re vulnerable

First, find out what you’re running:

nginx -v

If the output shows anything between 0.9.6 and 1.31.2, you’re in the affected range. The vulnerable code path only triggers when your NGINX configuration uses the map directive with a regular expression, which is common in configurations that do URL rewriting, header manipulation, or geo-based routing. But even if you don’t think you use map, check — it’s often pulled in through included configuration files you didn’t write yourself.

You can check whether your active configuration uses map with a regex:

nginx -T 2>/dev/null | grep -E '^\s*map\s+\$' | head -20

If you see output, assume you’re vulnerable and proceed to patching. If you don’t see output, you’re likely not exploitable through your current configuration, but you should still patch — configuration changes happen, and the next person to edit your nginx.conf might not know about this CVE. The safest approach is to assume vulnerability and upgrade regardless of your current config.

How to patch

The fixed versions are:

• NGINX Open Source stable: 1.30.3
• NGINX Open Source mainline: 1.31.3
• NGINX Plus: 37.0.3.1

Debian/Ubuntu with official NGINX repo. If you installed from nginx.org’s repository (check /etc/apt/sources.list.d/nginx.list), the update is already available:

sudo apt update && sudo apt install --only-upgrade nginx
nginx -v  # verify: should show 1.30.3 or 1.31.3

If you’re using the distro’s default repository, the package may not be updated yet. Check what’s available:

apt-cache policy nginx

If the distro package is still on a vulnerable version, switch to the official NGINX repo or wait for the backport. Distro maintainers typically ship security fixes within 24-72 hours.

RHEL/CentOS/Rocky/Alma. If you installed from the official NGINX repo:

sudo dnf update nginx

For systems using EPEL or base repos, the update timeline depends on Red Hat’s backport process. Monitor with dnf check-update nginx.

Docker deployments. The official images on Docker Hub have been updated. Pull the latest:

docker pull nginx:1.31.3        # mainline (recommended for new deployments)
docker pull nginx:1.30.3        # stable
docker pull nginx:stable-alpine # stable on Alpine (smaller image)

If you pin specific image tags in your Dockerfiles or compose files, update them to the patched version and rebuild. If you’re using nginx:latest, a simple pull and redeploy is enough. Verify inside the container:

docker exec <container-name> nginx -v

NGINX Plus. The update is available through the standard NGINX Plus repository. Run your normal update process. Verify with nginx -v — look for version 37.0.3.1 or higher.

After any upgrade, always test and reload:

nginx -t && sudo nginx -s reload

A configuration test failure after an upgrade usually means a deprecated directive was removed. NGINX is generally good about backward compatibility within a major version, but if you’re jumping from a very old release to 1.30.3, check the changelog for any directives that were deprecated in the interim.

If you can’t patch right now

If you’re stuck on an affected version due to compatibility constraints or change freezes, you have mitigation options that don’t require upgrading the binary. None of these are a substitute for the actual patch, but they reduce your exposure while you schedule the upgrade window.

Audit and remove regex from map blocks. If your map directives use string matching instead of regular expressions, the vulnerable code path isn’t triggered. A map with hostnames; and exact hostname matching is safe. A map that uses ~^/api/ or ~*\.php$ patterns is the attack surface. Search your configuration:

nginx -T 2>/dev/null | grep -B2 -A5 '^\s*map\s\+' | grep -E '(~|~\*)'

If this returns anything, those are your vulnerable patterns. Replace regex-based maps with exact matches, include files with explicit lists, or location-based alternatives where possible. For URL rewriting, consider using location blocks with exact prefix matching (location = /api/) instead of regex maps.

Add rate limiting at the server level. While F5 hasn’t published the exact trigger, crafted HTTP requests are the attack vector. Aggressive rate limiting won’t prevent a targeted attack, but it makes broad scanning much harder and buys you time:

limit_req_zone $binary_remote_addr zone=cve42533:10m rate=1r/s;

server {
    limit_req zone=cve42533 burst=3 nodelay;
    # rest of your config
}

Disable the map module entirely (nuclear option). NGINX can be recompiled without the ngx_http_map_module, but this is almost never practical on running production systems since the module is compiled in by default in every standard distribution package. If you’re building NGINX from source, add --without-http_map_module to your configure flags. For most people, this isn’t realistic — upgrading is faster and safer.

Monitor for worker restarts. The exploit causes worker crashes. If you see a sudden spike in worker process restarts, especially correlated with a specific source IP, you’re likely under active attack:

journalctl -u nginx --since "10 minutes ago" | grep -i "worker process.*exited"

Set up alerting on this log pattern if you’re running in a change freeze. It won’t stop the attack, but at least you’ll know it’s happening.

How bad is this really

F5 scored this 9.2 on the CVSS v4 scale and 8.1 on the older v3.1 scale. The attack complexity is rated high, which means exploitation isn’t trivial — the attacker needs to craft a specific request that triggers the buffer overflow in a way that accomplishes something useful, not just crash the worker. For the denial-of-service scenario, complexity is effectively low: sending crash-inducing requests is straightforward once the pattern is known. For remote code execution, the bar is higher but not insurmountable.

“High complexity” in CVSS terms doesn’t mean “impossible.” It means “requires skill and possibly multiple attempts.” For a vulnerability that’s been present in one of the most widely deployed pieces of server software for 15 years — NGINX powers roughly a third of all websites, including major platforms like Netflix, Dropbox, and WordPress.com — assume someone with resources is working on a reliable exploit. The 15-year window means there’s been plenty of time for both security researchers and threat actors to study the affected code path, even if they didn’t recognize it as exploitable until F5’s disclosure.

This is the kind of vulnerability that gets added to automated scanning toolkits within days of disclosure. By next week, every Shodan query for NGINX servers will be paired with an exploit attempt. If your NGINX instance is internet-facing and hasn’t been patched by the end of this week, you’re betting that no one has weaponized it yet. That’s not a bet worth taking when the fix is a single package update.

The patch is available now. The upgrade is one command on most systems. Run it, verify it, and move on with your day. Do it before the weekend.