CVE-2026-42533: NGINX Map Directive and Regex Matching Vulnerability
Summary
CVE-2026-42533: NGINX Map directive and Regex matching vulnerability. Affects nginx across 2 version ranges.
>= 0.9.6, < 1.30.4
>= 1.31.2, < 1.31.3
Fixed in 1.30.4 or 1.31.3, depending on the release line you run. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-42533 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. It is widely used for serving static content, load balancing, and handling high traffic loads. However, NGINX is susceptible to vulnerabilities, including CVE-2026-42533, which affects its map directive when using regex matching.
Vulnerability Detail
A vulnerability exists in NGINX Plus and NGINX Open Source related to the map directive that uses regex matching. This occurs when a string expression references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, potentially leading to a heap buffer overflow in the NGINX worker process. This may cause the NGINX system to restart or allow code execution on systems with Address Space Layout Randomization (ASLR) disabled.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.9.6, < 1.30.41.30.4 -
>= 1.31.2, < 1.31.31.31.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using regex capture variables in string expressions before referencing the map output variable. Review your NGINX configuration for any instances of this pattern and modify them accordingly.
Conclusion
CVE-2026-42533 is a critical vulnerability in NGINX that can lead to severe consequences if not addressed. It is essential to update to the patched versions or implement the recommended workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-42533 is a vulnerability in NGINX that affects the map directive when using regex matching, potentially leading to a denial-of-service or code execution.
Check your NGINX version against the fixed versions: 1.30.4 and 1.31.3. If you are using an earlier version, you are at risk.
Exploitation of this vulnerability may lead to a denial-of-service (DoS) condition or allow remote code execution on vulnerable systems.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground.
If an immediate update is not possible, implement the suggested workaround by avoiding the use of regex capture variables in your NGINX configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
