Select a theme from the list.
Insights

From our experts

Latest
Fresh SharePoint Exploitation Shrinks the Window Between Patch and AttackHelloNet Campaign Turns Trusted ViPNet Components Into an Espionage LaunchpadCritical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade PathNichirei Cyberattack Sends Digital Disruption Into the Cold ChainNadMesh Botnet Raids Exposed AI Servers for Cloud CredentialsACR Stealer Turns Fake Fixes Into Enterprise Data TheftMicrosoft Warns That Overprivileged AI Agents Are Becoming a New Identity RiskDigiCert Intrusion Reveals How Stolen Code-Signing Trust Can Shield MalwareAbbott Investigates Two Cyber Incidents as Extortion Claims Target Diagnostics OperationsSophos Fusion Recasts the Security Platform as an AI-Driven Defense SystemShark Vacuum Cloud Weakness Turns One Device Certificate Into a Regional Master KeyTrusted Meeting Apps Become the Bait in a Multi-Layer Windows Malware CampaignFresh SharePoint Exploitation Shrinks the Window Between Patch and AttackHelloNet Campaign Turns Trusted ViPNet Components Into an Espionage LaunchpadCritical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade PathNichirei Cyberattack Sends Digital Disruption Into the Cold ChainNadMesh Botnet Raids Exposed AI Servers for Cloud CredentialsACR Stealer Turns Fake Fixes Into Enterprise Data TheftMicrosoft Warns That Overprivileged AI Agents Are Becoming a New Identity RiskDigiCert Intrusion Reveals How Stolen Code-Signing Trust Can Shield MalwareAbbott Investigates Two Cyber Incidents as Extortion Claims Target Diagnostics OperationsSophos Fusion Recasts the Security Platform as an AI-Driven Defense SystemShark Vacuum Cloud Weakness Turns One Device Certificate Into a Regional Master KeyTrusted Meeting Apps Become the Bait in a Multi-Layer Windows Malware Campaign
Security Insight

Critical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade Path

Source
Critical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade Path
Photo by Sergei Starostin on Pexels

F5 has patched a critical heap buffer overflow affecting a broad range of NGINX versions and related products. A remote, unauthenticated attacker can crash vulnerable worker processes, while researchers warn that some configurations may also permit remote code execution. Exposure depends on how regular-expression maps and captured variables are used in the server configuration.

News Date: 2026-07-19

A critical vulnerability in NGINX has created an urgent upgrade requirement for organizations using the widely deployed web server, reverse proxy and application delivery platform. Tracked as CVE-2026-42533, the flaw allows a remote, unauthenticated attacker to trigger a heap buffer overflow by sending specially crafted HTTP requests.

A Configuration-Dependent Threat

The weakness is located in the NGINX script engine, which evaluates variables and constructs strings used by configuration directives. It becomes exploitable when a regular-expression-based map is combined with numbered capture variables from an earlier match in a particular order.

Under those conditions, the engine can calculate one buffer size during its first processing pass but write a larger, attacker-controlled value during the second. The immediate result may be a worker crash and denial of service. F5 has also warned that remote code execution could be possible when address space layout randomization is disabled or successfully bypassed.

Independent research suggests the flaw may leak memory addresses under some circumstances, potentially helping attackers defeat memory protections. Public exploit code was not available when the report was published, but delayed patching would give researchers and criminals more time to develop reliable attack techniques.

Versions and Products at Risk

The vulnerable range extends from NGINX 0.9.6 through 1.31.2, covering releases dating back to 2011. F5 also identified exposure in products including NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF and NGINX Instance Manager.

Recommended Actions

  • Upgrade open-source NGINX to version 1.30.4 or 1.31.3.
  • Upgrade NGINX Plus to version 37.0.3.1.
  • Search configurations for regex maps used with numbered captures.
  • Test application routing and rewrite behavior after upgrading.
  • Monitor web servers for unexplained worker crashes or restarts.

F5 suggested named captures as a temporary mitigation, but researchers have identified a narrower variation that may survive that change. In my view, configuration workarounds should not be treated as an acceptable long-term substitute for installing a fixed release. NGINX often sits directly in front of critical applications, so even a configuration-specific flaw can create substantial business risk when it affects a shared gateway, cloud ingress service or public website.

Talk to our team →

Latest

Fresh SharePoint Exploitation Shrinks the Window Between Patch and AttackJul 20, 2026HelloNet Campaign Turns Trusted ViPNet Components Into an Espionage LaunchpadJul 20, 2026Critical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade PathJul 20, 2026Nichirei Cyberattack Sends Digital Disruption Into the Cold ChainJul 19, 2026NadMesh Botnet Raids Exposed AI Servers for Cloud CredentialsJul 19, 2026ACR Stealer Turns Fake Fixes Into Enterprise Data TheftJul 19, 2026

Most read

1Global CMS Exploitation Wave Plants Webshells on Business Websites2Sophos Fusion Recasts the Security Platform as an AI-Driven Defense System3Microsoft Prepares Windows Customers for a Faster Era of AI-Driven Patching4Exposed Attack Server Unmasks Three Microsoft 365 Phishing Operations5Laser Attack Exposes an Unpatchable Weakness in Tangem Crypto Wallet Cards6Critical NGINX Overflow Puts Internet-Facing Servers on an Urgent Upgrade Path