NGINX Map Directive Heap Buffer Overflow Enables Denial of Service and Potential Remote Code Execution CVE – 2026 – 42533
Red Hat has issued security advisory RHSA-2026:67315 addressing CVE-2026-42533, a vulnerability affecting the NGINX 1.24 module on Red Hat Enterprise Linux 8. The flaw allows a remote, unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests when NGINX is configured with a "map" directive that performs regular-expression matching and references regex capture variables before the corresponding map output variable. Red Hat rates the advisory as Moderate and assigns the vulnerability a CVSS v3.1 score of 7.0, while upstream scoring rates it as high severity. The update affects RHEL 8 deployments across x86_64, ARM 64, IBM Z and Power little-endian architectures, including applicable RHEL 8.10 Extended Life Cycle releases.
Successful exploitation can corrupt memory within an NGINX worker process, most commonly causing the worker to crash and restart, resulting in a denial-of-service condition. Under more favorable exploitation conditions, the vulnerability may also enable arbitrary code execution; however, Red Hat assesses this scenario as significantly less likely on RHEL because Address Space Layout Randomization (ASLR) is enabled by default. Exploitation therefore depends not only on network accessibility but also on the presence of the affected NGINX configuration and, for reliable code execution, the attacker's ability to operate without ASLR protection or successfully bypass it. Red Hat has released fixed "nginx-1.24.0-3" packages through RHSA-2026:67315, while upstream NGINX identifies versions 1.30.4 and 1.31.3 or later as not vulnerable.
The vulnerability is particularly relevant to organizations using NGINX as an internet-facing web server, reverse proxy, load balancer or application gateway, where crafted requests may be delivered directly to vulnerable configurations. Public proof-of-concept material is available, increasing the likelihood of opportunistic scanning and exploit development against exposed systems; however, there is currently no authoritative evidence confirming widespread in-the-wild exploitation or inclusion in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 4.45%, indicating a measurable probability of exploitation activity while still requiring configuration-specific conditions for success. Organizations should therefore prioritize identification of vulnerable NGINX configurations and deployment of Red Hat's patched packages, particularly on publicly accessible infrastructure.
Attack Surface
Web Application, Server OS
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update the NGINX 1.24 module to 1.24.0-3.module+el8.10.0+24848+0300f002.5 or later on all affected Red Hat Enterprise Linux 8 systems, as specified in Red Hat Security Advisory RHSA-2026:67315. Red Hat recommends applying the security update as the primary remediation for CVE-2026-42533.
- Apply the security update according to Red Hat's documented RHEL package-update procedure. For RHEL 8 systems, administrators can use the supported dnf update workflow and should ensure that all relevant previously released errata are also applied.
- Verify the integrity and installed version of updated NGINX packages against the package information and SHA-256 hashes published in RHSA-2026:67315. For example, the x86_64 package nginx-1.24.0-3.module+el8.10.0+24848+0300f002.5.x86_64.rpm has the published SHA-256 value 3f2aa23170ff5b24e69ee10f5887f268a7bc417d2a4915c8c6d93b7aa661f350.
- Review NGINX configurations for vulnerable map directives that use regular-expression matching and unnamed regex capture variables. As an interim mitigation where immediate patching is not possible, Red Hat recommends replacing unnamed captures with named captures and using them only within the same block as the corresponding regex match.
- Ensure Address Space Layout Randomization (ASLR) remains enabled on all affected RHEL systems. Red Hat states that ASLR is enabled by default and significantly reduces the likelihood of successfully converting the heap buffer overflow into reliable arbitrary code execution.
- Monitor NGINX access and error logs for anomalous HTTP activity correlated with worker-process crashes or restarts, particularly repeated requests immediately preceding segmentation faults, memory-related errors, unexpected worker termination, or service availability degradation
- Configure SIEM and endpoint monitoring to detect abnormal NGINX process behavior, including repeated worker crashes, unexpected child processes, shell or command-interpreter execution initiated by an NGINX worker, and unusual outbound network connections associated with the NGINX service account.
- Use Web Application Firewall, reverse-proxy, or API-gateway controls as defense-in-depth measures to restrict anomalous request patterns, rate-limit suspicious clients, and reduce direct exposure of vulnerable NGINX instances. These controls should not be considered substitutes for patching because the vulnerability is triggered by application-specific map and regex processing rather than simply non-compliant HTTP syntax.
- Restrict direct exposure of NGINX services where operationally feasible, particularly administrative or internally intended applications. Use trusted load balancers, reverse proxies, network ACLs, or firewall controls to limit which services and source networks can directly reach affected NGINX deployments.
- Perform a retrospective review of internet-facing vulnerable NGINX systems for evidence of exploitation, focusing on unexplained NGINX worker crashes, recurring service restarts, unusual HTTP activity, unexpected processes executed under the NGINX account, suspicious outbound connections, or other activity occurring after public proof-of-concept information became available.
