BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportHigh impact

F5 Releases Patches for Critical NGINX Vulnerability Allowing Remote Code Execution

Aggregated by BrevFeed security · updated 74d ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • CVE-2026-42533 allows heap buffer overflows via crafted HTTP requests.
  • Affects NGINX versions from 0.9.6 to 1.31.2 depending on configuration.
  • Patch available in nginx 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1.

Overview of the Vulnerability

F5 has addressed a critical vulnerability in NGINX designated as CVE-2026-42533. This flaw permits unauthenticated attackers to exploit a heap buffer overflow in the worker process by sending crafted HTTP requests, potentially leading to service disruptions and remote code execution.

Details of the Exploit

The vulnerability arises from specific configurations involving regex-based maps where an output variable is referenced following a regex match. The defect can cause the buffer allocated during request processing to be incorrectly sized, allowing for an attacker to overwrite the buffer and control the flow of execution.

Impact Assessment

F5 rates the CVE-2026-42533 with a CVSS v4 score of 9.2, indicating severe risk. The flaw primarily affects versions of NGINX prior to the patched releases, illustrating the need for users to update to the latest versions to mitigate the risk.

Affected Products and Recommendations

The vulnerability threatens various NGINX products, including the NGINX Ingress Controller and NGINX Plus. Users are advised to upgrade to the specified patched versions to ensure protection against potential exploits. F5 has yet to provide fixes for the other affected products at this time.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 7m ago security GitLab RCE PoC Published for Authenticated Users on Unpatched Servers 18d ago security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 3h ago security Critical RCE Flaw in Forminator WordPress Plugin Affects 600,000+ Sites 6d ago security Chrome 150 Update Addresses 27 Vulnerabilities, Enhances Security 2d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~34 min · 27 stories · Oct 02

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

GitHub 0xCyberstan/CVE-2026-42533-Config-Scanner CVE CVE-2026-425338.1 HIGH CVE CVE-2026-429458.1 HIGH CVE CVE-2026-92568.1 HIGH

Reporting from

The Hacker News — Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution 74d ago →

F5 has released security patches for a critical vulnerability in NGINX (CVE-2026-42533) that allows remote attackers to trigger a heap buffer overflow, potentially leading to remote code execution and denial of service. This vulnerability affects numerous NGINX versions and some configurations, which could expose many installations unless updated.