Public Scanner Released for NGINX Map Regex Flaw; Full RCE Exploit Expected Around August 5

Researcher Stan Shaw, known as cyberstan, published an open-source static scanner on July 20, 2026 to detect configurations vulnerable to CVE-2026-42533. The vulnerability, a heap buffer overflow in the NGINX scripting engine triggered by interactions between map directives with regex and prior capture variables, carries a potentially critical impact according to the researcher's claims. Shaw asserts the flaw autonomously bypasses ASLR via an information leak primitive, making remote code execution reliable even on systems with ASLR enabled. The full exploit is expected around August 5, leaving organizations roughly two weeks to act.

Source limitations: Shaw's claims regarding the ASLR bypass have not been independently verified; the proof-of-concept is expected but not guaranteed for the stated date. Information is based on the researcher's statements and cited sources; the absence of a public exploit prevents independent verification.

The Mechanism: How a Regex Map Corrupts Capture State

The flaw resides in NGINX's two-pass scripting engine. During the first pass (LEN), the system allocates a buffer based on length measurement using the regex capture state. During the second pass (VALUE), the same map regex evaluation can overwrite the capture state via the shared r->captures array.

This creates a fundamental mismatch: the buffer is sized for one capture but written with another. If the replacement is longer, a heap buffer overflow occurs. According to the researcher's claims, the system may read uninitialized heap bytes. Shaw identified at least 13 independent call sites across 9 NGINX source files, affecting both HTTP and stream modules.

The Gap Between the F5 Advisory and Researcher Claims

The F5 advisory dated July 15, 2026 describes CVE-2026-42533 with a precise condition: remote code execution is possible only with "ASLR disabled or bypassable." Shaw contests this framing.

CLAIM — Researcher: According to Shaw, the vulnerability itself provides the bypass mechanism through the information leak primitive, rendering any external precondition on ASLR superfluous. The Hacker News reports the researcher's view that "the flaw provides the bypass itself."

"A reader of the F5 advisory could reasonably conclude that on default systems this is only DoS. That is not the case." — Stan Shaw (cyberstan) to The Hacker News

Shaw stated he achieved remote code execution with a claimed 10-of-10 reliability on Ubuntu 24.04 with ASLR enabled, using approximately 40 spray connections between the leak request and the overflow trigger. If confirmed by the proof-of-concept release, this assertion would remove a common exploitation barrier that defense teams consider standard.

The CVSS 4.0 score assigned by F5 is 9.2 (Critical), while the legacy CVSS 3.1 is 8.1 (High), both according to the official CVE.org record and the NVD entry. The National Vulnerability Database classifies the vulnerability as CWE-122.

Why F5's Temporary Mitigation Is Incomplete

F5 proposed replacing numbered captures with named captures as a temporary mitigation. Shaw verified with AddressSanitizer that this countermeasure leaves a second path open: when a map defines the same named group as a location regex, the overflow mechanism is reached through a different variant.

The researcher therefore reiterated that "upgrading to 1.30.4 / 1.31.3 is the only complete fix."

Immediate Actions

• Audit configurations with the released scanner: use the open-source tool 0xCyberstan/CVE-2026-42533-Config-Scanner, published on GitHub on July 20, 2026, to identify configurations with map directives that employ regex with numbered capture variables.
• Upgrade to patched versions: install NGINX 1.30.4 (stable branch), 1.31.3 (mainline branch), or NGINX Plus 37.0.3.1, per the vendor's official release notes.
• Assess ingress-nginx exposure: the Kubernetes ingress-nginx repository is archived and ships NGINX 1.27.1, which will not receive a vendor fix.
• Plan for the disclosure window: given roughly 21 days of embargo from the patch (July 15) to the estimated August 5, 2026 date, teams must complete patching before the potential full exploit release.

Precedent and Context: The Lesson of CVE-2026-42945

The case recalls the recent NGINX Rift vulnerability (CVE-2026-42945), which was actively exploited in the days following disclosure. Although the two vulnerabilities share a structural root in the NGINX regex engine, they are distinct entities: CVE-2026-42533 does not appear in the CISA KEV catalog as of July 20, 2026, with no confirmed public exploit beyond the configuration scanner.

The nature of the disclosure — public patch, immediate scanner, deferred exploit — represents a high-risk temporal configuration for organizations running NGINX on roughly one-third of global web servers.