What happened

Heads up: a nasty bug (CVE-2026-42533) in nginx’s script engine can be triggered by specially crafted HTTP requests. It was patched on July 15 in nginx 1.30.4 (stable), 1.31.3 (mainline) and NGINX Plus 37.0.3.1. If you run anything older, you should assume you might be vulnerable.

In plain(ish) English: under a particular configuration involving a regex-based map and a numbered capture (think $1) referenced later in a string, the engine’s two-pass evaluation gets tripped up. The first pass measures how many bytes it needs and allocates a buffer; the second pass writes the bytes in. If a regex in a map is evaluated between those passes it can clobber the capture state, causing the writer to stuff more data into a buffer sized for something smaller — a classic heap overflow.

That overflow can crash or restart a worker (DoS). Where address space layout randomization (ASLR) is off or can be bypassed, researchers warn the bug may also be wormfood for remote code execution because the overrun and its size come directly from the request. One researcher reports being able to recover heap addresses on a default Ubuntu build with a single request; others confirm this is not just theoretical. Exposure depends on configuration, not just version, so not every nginx server is reachable by this issue.

What you should do right now

Short checklist for the panicked and the careful:

  • Upgrade to nginx 1.30.4 or 1.31.3 (or NGINX Plus 37.0.3.1) as soon as you can. This is the complete fix.
  • If you can’t patch immediately, switch affected regex maps to named captures as a temporary mitigation — but be warned: a researcher has demonstrated a narrower alternate path that still reaches the overflow, so this is only a stopgap.
  • Audit your configs for the telltale pattern: a regex-based map whose variable is used in a string expression together with a numbered capture (for example, a $1) where the capture appears earlier in the expression than the map variable. If that weird ordering exists, treat it as high-risk.
  • Watch downstream NGINX-based products (Ingress controllers, gateway fabrics, WAFs, instance managers) — some vendors list them as affected and may not have released fixed builds yet.
  • Monitor for published proof-of-concept exploits and prioritize patching if one appears. This is at least the third similar heap-overflow in nginx’s expression evaluator in recent months, so attackers are paying attention.

If you want to be thorough, a researcher published a non-exploit config scanner that looks for the specific ordering that makes a config exploitable; it follows includes and flags only the dangerous patterns. Use tools like that carefully and only against systems you own or are authorised to test.

Final note: this isn’t a generic nginx panic button — the vulnerability requires a specific config pattern — but the consequences can be severe. Patch fast, check your maps, and try not to let your workers get into a heap of trouble.