A 15‑Year‑Old NGINX Map Regex RCE Flaw (CVE‑2026‑42533): Deep Technical Breakdown

Vulnerability Overview

CVE‑2026‑42533 is a heap buffer overflow and information‑leak vulnerability in NGINX’s script engine when a map directive uses a regular‑expression match. The engine fails to preserve the request capture state ( r->captures) between the length‑calculation (LEN) pass and the value‑writing (VALUE) pass, allowing a crafted request to overflow a buffer and achieve unauthenticated remote code execution after bypassing ASLR.

Affected Versions

All NGINX releases from 0.9.6 (when regex support was added to map on 21 Mar 2011) through the stable 1.30.3 and mainline 1.31.2 are vulnerable.

Root Cause: Two‑Pass Evaluation Model

Engine’s two‑pass evaluation

NGINX compiles expressions containing variables with ngx_http_complex_value() (source src/http/ngx_http_script.c). The function performs:

LEN pass : iterates over the opcode sequence, summing fragment lengths to allocate a buffer of exact size.

VALUE pass : re‑iterates the same opcodes and writes the actual content into the allocated buffer.

The design assumes each opcode produces identical length in both passes. If the LEN pass under‑estimates a fragment, the VALUE pass writes beyond the allocated buffer.

Capture‑state pollution

During a regex match, NGINX stores capture offsets and pointers in r->captures and r->captures_data. The $1 reference reads these fields. When a map variable with a regex is evaluated, ngx_http_regex_exec() overwrites r->captures with the new match data. Neither ngx_http_complex_value() nor ngx_http_map_find() saves or restores the original capture state.

Example expression:

"$1=$map_var=$1"   # $map_var is a map variable that uses a regex

LEN phase:

Read original $1 (e.g., URI path “abc”, 3 bytes).

Evaluate map_var, trigger regex, overwrite r->captures.

Read polluted $1 (200 bytes, the map input string).

Total length = 3 + 1 + 6 + 1 + 200 = 211 bytes ; allocate a 211‑byte buffer.

VALUE phase:

Write polluted $1 (200 bytes).

Write map_var value “mapped” (6 bytes).

Write polluted $1 again (200 bytes).

Total write = 200 + 1 + 6 + 1 + 200 = 408 bytes into a 211‑byte buffer, causing a 197‑byte heap overflow fully controlled by the attacker.

Information Leak: Single‑Request ASLR Bypass

If the map input is shorter than the original capture, the VALUE pass writes fewer bytes than the LEN‑estimated length. The buffer tail retains residual heap data, which can contain libc and heap pointers. Sending an 8 160‑byte URI path together with a 1‑byte header triggers the map regex, allocating an 8 161‑byte buffer but initializing only 2 bytes. The remaining 8 159 bytes reliably include a libc pointer and a heap pointer, enabling an unauthenticated GET request to read these pointers and compute the ASLR base address.

Impact Scope

The vulnerable pattern appears in at least thirteen independent call sites across nine source files, all using the opcodes copy_capture_len_code and copy_capture_code without preserving r->captures. Affected core locations include: ngx_http_complex_value() (used by return, add_header, proxy_set_header, etc.) ngx_stream_complex_value() (used by Stream module’s return, set, proxy_pass) proxy_set_header /

proxy_set_body

fastcgi_param

, scgi_param, uwsgi_param,

grpc_set_header

proxy_v2

body path index directive

Cross‑directive exploitation does not require the capture and map variable to appear in the same directive; modules such as proxy, fastcgi, scgi, uwsgi, and grpc each run their own two‑pass loops within a location block, sharing the same buffer.

Typical vulnerable configuration:

location ~ "^/api/(.+)$" {
    proxy_set_header X-Path "$1";
    proxy_set_header X-Check "$map_var";  # $map_var is a regex map variable
    proxy_pass http://backend;
}

During the LEN phase, $1 is read first, then $map_var triggers a regex match that overwrites the capture state. In the VALUE phase, the polluted $1 writes far more data than the LEN phase measured, causing the overflow.

Risk Assessment

Exploitation prerequisite : No authentication or client certificate required; a specially crafted HTTP request suffices.

Exploitation difficulty : Information leak (ASLR bypass) can be completed with a single GET request; overflow triggers reliably (10/10 tests).

Impact : Pre‑authentication remote code execution, full control of the NGINX server.

Trigger conditions : Configuration contains (1) a location/rewriter/server_name regex that creates captures (e.g., $1) and (2) a regex map variable evaluated later in the same location or subsequent directives.

Historical span : 21 Mar 2011 – 15 Jul 2026 (≈15 years).

Mitigation

Open‑source NGINX

Stable branch: upgrade to 1.30.4 or later.

Mainline branch: upgrade to 1.31.3 or later.

NGINX Plus (commercial)

R33–R36: upgrade to R36 P7 or later.

R37.0.0.1–R37.0.2.1: upgrade to 37.0.3.1 or later.

Optional verification step:

Run the configuration scanner at https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner to detect vulnerable patterns.

Important note : Other NGINX CVEs disclosed in 2026 (CVE‑2026‑42945, CVE‑2026‑9256, CVE‑2026‑42055, CVE‑2026‑48142) do not address this flaw; upgrading to the versions listed above is required.

Conclusion

CVE‑2026‑42533 stems from the script engine’s assumption that the shared mutable state r->captures remains unchanged between the LEN and VALUE passes. Capture‑state pollution enables a precisely controlled heap overflow and memory leak, which together allow pre‑authentication remote code execution. The vulnerability persisted for fifteen years across thirteen call points, and a single crafted HTTP request can compromise any unpatched NGINX deployment.