TLP: CLEAR
CanSSOC Threat Assessment ^[*]: HIGH

1. Overview
2. Summary
3. Details
4. Recommendations
5. References
6. Support

We received this report from CanSSOC about a critical vulnerability in NGINX. It is primarily a denial-of-service vulnerability, but F5 says it could also be used for Remote code execution. Only a private exploit exists at this point, but the researcher has said it will be withheld until users have sufficient time to apply patches, citing concerns over rapid exploitation. At present, the date for this is August 5th.

There is a mitigation listed below, and for a server to be exploitable, it must be running an impacted version and be using unnamed captures in map directives. Please either implement the mitigation or patch as soon as reasonable, but no later than August 5th.

On July 21, 2026, F5 disclosed and patched CVE-2026-42533, a critical-severity heap-based buffer overflow vulnerability affecting various versions of NGINX. Successful exploitation could allow threat actors to cause a denial-of-service (DoS) condition or execute arbitrary code on affected systems.

• CVE: CVE-2026-42533 – CVSSv4.0: 9.2 EPSS: 0.83% / P53
• Impacted versions:
  • NGINX Plus (37.0.0.1–37.0.2.1)
  • NGINX Open Source (1.31.2 and 1.30.0–1.30.3)
  • NGINX Instance Manager (2.17.0–2.22.1)
  • F5 WAF for NGINX (5.9.0–5.13.3)
  • NGINX App Protect WAF (4.11.0–4.16.0 and 5.2.0–5.8.0)
  • NGINX Gateway Fabric (1.3.0–1.6.2 and 2.0.0–2.6.6)
  • NGINX Ingress Controller (2026-lts-r1–2026-lts-r3, 5.0.0–5.5.2, 4.0.0–4.0.1, and 3.5.0–3.7.2)
• Fixed versions:
  • NGINX Plus 37.0.3.1
  • NGINX Open Source 1.31.3 and 1.30.4
  • NGINX Instance Manager 2.22.2
  • F5 WAF for NGINX 5.13.4
  • NGINX Gateway Fabric 2.6.7
  • NGINX Ingress Controller 2026-lts-r4 and 5.5.3
• Active exploitation: There are no known instances of active exploitation.

• Apply patches to affected versions.
• To mitigate this vulnerability, do not use unnamed captures. Use unique named captures instead and only use them in the same block with the regex match. Do not reuse unique named captures in regex match in different directives, ex: in both a map directive and in a location block.

1. [Vendor Advisory] – NGINX map directive and regex matching vulnerability CVE-2026-42533
2. [Details] – Critical NGINX vulnerability can crash workers and may allow remote code execution
3. [CCCS] – Cyber security guidance

As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.

[*] The CanSSOC Threat Assessment has the following four scores: LOW, MEDIUM, HIGH, SEVERE.