Debian Patches Three nginx Flaws That Risk Crashes Memory Leaks and Code Execution
Debian has published security update DSA-6496-1 for nginx, the high performance web server and reverse proxy that fronts many internet facing applications. Three flaws are covered: CVE-2026-42533, CVE-2026-56434 and CVE-2026-60005. Between them they may result in denial of service, disclosure of process memory, or potentially the execution of arbitrary code. Any Debian host running the nginx packages is in scope, with risk depending on whether the affected directives appear in the configuration.
CVE-2026-42533 is a heap buffer overflow in the nginx script engine, triggered when a map directive performs regular expression matching and a string expression references captures the map has modified, or when non cacheable variables change between the script length and script copy passes. CVE-2026-56434 is a use after free from duplicate finalisation of an HTTP subrequest, seen where server side includes are combined with proxy_pass and proxy_buffering disabled and an upstream response causes the same subrequest to be posted twice. CVE-2026-60005 lies in ngx_http_regex_exec, which could replace the captures array without clearing r->ncaptures on a failed match, letting a later unnamed capture read uninitialised memory.
nginx typically sits at the network edge, so memory disclosure can leak fragments of other users' requests, while a crash takes the service with it, potentially affecting sites behind it. Exploitation remains unlikely for now: FIRST EPSS puts CVE-2026-42533 at 0.9 percent over the next 30 days, CVE-2026-56434 at 0.4 percent and CVE-2026-60005 at 0.5 percent. There is no reported in the wild exploitation, and fixed packages are already available from Debian.
Attack Surface
Web Application, Infrastructure, Server OS
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Apply DSA-6496-1 on every Debian host running nginx with apt-get update && apt-get install –only-upgrade nginx nginx-common nginx-core, then confirm with dpkg -l nginx that the installed version matches the fixed version listed for your Debian release in DSA-6496-1.
- Restart the service with systemctl restart nginx after the upgrade and verify with nginx -V and systemctl status nginx that no worker processes are still executing the pre-patch binary.
- Audit configurations for the CVE-2026-42533 trigger pattern using grep -R 'map ' /etc/nginx/ and flag any map block whose regex captures are referenced in a later string expression, treating those virtual hosts as the highest patch priority.
- Identify the CVE-2026-56434 configuration with grep -R -e 'ssi on' -e 'proxy_buffering off' /etc/nginx/ and, where an upgrade window cannot be scheduled, re-enable proxy_buffering on locations that combine server side includes with proxy_pass.
- Alert in the SIEM on /var/log/nginx/error.log entries matching 'worker process' and 'exited on signal 11' or 'signal 6', which indicate the SIGSEGV or abort behaviour expected from the heap overflow and use after free being triggered.
- Rebuild and redeploy any container images or appliance builds derived from Debian nginx packages, including OpenResty style derivatives, since running containers keep the vulnerable nginx binary until the image layer is replaced.
