nginx just took its third critical hit in the same fragile corner of its codebase this year — and this one has been sitting there since 2011.
Tracked as CVE-2026-42533 is a pre-authentication remote code execution flaw carrying a critical 9.2 CVSS v4.0 score. It affects the nginx open source from 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline), plus NGINX Plus R33–R36 and multiple 37.x builds. Fixes shipped in nginx 1.30.4, 1.31.3, and NGINX Plus R36 P7 / 37.0.3.1.
Researcher Stan Shaw (cyberstan) traced the bug to nginx's map directive when it uses regex matching (pattern-based text rules). The server evaluates certain expressions in two passes — one to measure the output size, one to write it — and both read the same shared capture array (r->captures).
When a regex map fires between the passes, it silently overwrites that array. The buffer gets sized for one value and filled with another, producing either a heap overflow stuffed with attacker-controlled bytes or an information leak that exposes memory pointers and defeats ASLR (a key anti-exploit defense) in a single request.
This is the third two-pass "measure then write" mismatch found in nginx's script engine in months — after NGINX Rift (CVE-2026-42945), the 18-year-old rewrite-module overflow that was later exploited in the wild, and nginx-poolslip (CVE-2026-9256) days behind it.
Shaw explicitly frames CVE-2026-42533 as the same structural weakness, noting that, unlike Rift, his info-leak defeats ASLR without needing it disabled — and that Rift saw active exploitation soon after its PoC dropped.
The flawed pattern spans 13 separate code sites across nginx's HTTP and stream modules, and Shaw reports the chained exploit hit 10-out-of-10 reliability on Ubuntu 24.04 with full ASLR on. The behavior isn't even new: a 2014 nginx ticket flagged the capture-clobbering quirk, but nobody connected it to memory safety until now.
Admins should patch immediately. As a stopgap, F5 recommends named captures used within the same block as the regex match, and Shaw has released a config scanner to flag exposed setups. He's holding the full exploit for 21 days post-patch — deliberately, to buy defenders time.