NGINX CVE-2026-42533

Exploitation requires a specific server-side configuration: the NGINX config must use a map directive with regex matching, and a string expression must reference the map's regex capture variables before referencing the map output variable - or, alternatively, use a non-cacheable variable in a string expression under certain conditions. Given that specific config, an unauthenticated remote attacker can trigger the overflow via crafted HTTP requests (PR:N, UI:N). The DoS/worker-restart outcome is the baseline result. Code execution is additionally gated on the target host having ASLR disabled or the attacker being able to bypass ASLR, and F5 notes success depends on 'conditions beyond the attacker's control,' consistent with the CVSS AC:H rating. Key limiting factors: default hardened deployments with ASLR enabled cap impact at DoS; instances not using the vulnerable regex-capture/non-cacheable-variable map pattern are not exploitable; EoTS versions were not evaluated.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable and unauthenticated, but crucially AC:H, reflecting that successful exploitation depends on 'conditions beyond the attacker's control' as F5 states explicitly. The realistic default outcome is a worker-process crash/restart (DoS); the C:H/I:H code-execution rating only materializes on systems where ASLR is disabled or the attacker can otherwise bypass ASLR, which is a meaningful additional prerequisite not met in most modern hardened deployments. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is not confirmed actively exploited. EPSS was not provided in the input and cannot be cited. Net assessment: for the vast majority of default, ASLR-enabled deployments the practical risk is availability impact (DoS), and it is only exploitable at all if the specific vulnerable map/regex-capture or non-cacheable-variable configuration pattern is present - making this a real-but-conditional priority rather than a broadly wormable RCE.

An attacker who has identified (or blindly targets) an NGINX instance whose configuration uses a regex map with capture variables referenced ahead of the map output variable sends specially crafted HTTP requests that drive the vulnerable string evaluation, overflowing the heap and crashing the worker process to cause repeated restarts and denial of service. On a target where ASLR is disabled or can be bypassed, the same overflow could be shaped toward arbitrary code execution in the worker process context. No public proof-of-concept has been identified, and the high attack complexity means the attacker relies on configuration and environmental conditions outside their direct control.