CVE-2026-42533
HIGHF5 NGINX Plus - NGINX Map Directive and Regex Matching Vulnerability
Title source: ruleExploitation Summary
EIP tracks 7 public exploits for CVE-2026-42533. PoCs published by 0xCyberstan, gagaltotal, seguridadentrerios.
AI-analyzed exploit summary This tool statically analyzes nginx configurations to detect preconditions for CVE-2026-42533, a two-pass capture-clobbering bug in nginx's complex_value buffer handling. The vulnerability arises when regex captures and map variables share a buffer, leading to heap overflows or uninitialized heap disclosures. The scanner does not exploit the vulnerability but identifies vulnerable configurations.
Description
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Exploits (7)
This tool statically analyzes nginx configurations to detect preconditions for CVE-2026-42533, a two-pass capture-clobbering bug in nginx's complex_value buffer handling. The vulnerability arises when regex captures and map variables share a buffer, leading to heap overflows or uninitialized heap disclosures. The scanner does not exploit the vulnerability but identifies vulnerable configurations.
This repository contains a Go-based static analysis tool that scans nginx configuration files for patterns vulnerable to CVE-2026-42533, a complex_value two-pass capture-clobbering issue leading to heap out-of-bounds writes or information disclosure. The tool parses configurations to detect risky regex captures and map variable interactions without exploiting the vulnerability.
This Bash script checks for potential exposure to CVE-2026-42533 in NGINX by verifying the installed version and scanning configuration files for vulnerable 'map' directives and regex patterns. It does not exploit the vulnerability but identifies at-risk configurations.
This Bash script checks for potential exposure to CVE-2026-42533 in NGINX by verifying the installed version and scanning configuration files for vulnerable 'map' directives and regex patterns. It does not exploit the vulnerability but identifies at-risk configurations.
This repository provides a Vagrant-based testbed environment for demonstrating a two-stage exploit chain involving CVE-2026-42533 (Nginx PCRE RCE) and CVE-2026-43449 (Linux kernel LPE). It includes detailed technical documentation and provisioning scripts but no actual exploit code.
This repository provides a defensive heuristic scanner for CVE-2026-42533, a vulnerability in NGINX related to regex map patterns with captures that could lead to buffer overflow or worker crashes. The tool audits NGINX configurations to identify risky patterns but does not exploit the vulnerability.
This tool statically analyzes nginx configurations to detect preconditions for CVE-2026-42533, a two-pass capture-clobbering bug in nginx's complex_value buffer handling. The vulnerability arises when regex captures and map variables share a buffer, leading to heap overflows or uninitialized heap disclosures. The scanner flags vulnerable configurations but does not exploit them.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H