Nginx patches 15-year-old regex map flaw that crashes workers, may allow RCE

A critical flaw affects virtually every Nginx release of the past 15 years. CVE-2026-42533, rated CVSS 9.2, entered the codebase in March 2011 and spans versions 0.9.6 through 1.31.2. The heap buffer overflow lives in the script engine and triggers when a regex-based map block feeds a variable into a string expression after an earlier regex match has set capture groups — the root cause being PCRE state that isn’t properly managed across evaluation passes.

No authentication is required. A worker crash is the guaranteed outcome; researcher Stan Shaw argues remote code execution is realistic where ASLR is disabled or can be bypassed. Fixed builds are 1.30.4 (stable), 1.31.3 (mainline) and NGINX Plus 37.0.3.1. Shaw plans to publish a proof of concept 21 days after the patch, in early August.

Only configurations using the described map pattern are exposed, but relying on that is risky: switching to named captures does not cover every vulnerable path, so updating is the only complete fix. If Nginx fronts your self-hosted services as a reverse proxy, audit the config before the exploit drops.