# Critical NGINX Flaw Exposes Servers to Remote Code Execution

*Published July 26, 2026*
*Source: [https://cybersecuritynews.com/15-year-old-nginx-vulnerability/](https://cybersecuritynews.com/15-year-old-nginx-vulnerability/)*

## Executive Summary

A newly disclosed NGINX vulnerability, CVE-2026-42533, has exposed servers to potential remote code execution by exploiting regex-related flaws in its script engine since March 2011. Patches have been released to address this critical issue, but many systems remain vulnerable due to the complexity of the exploit.

## Article

A critical vulnerability identified as CVE-2026-42533 has been found in the script engine of NGINX, a popular web server software, potentially allowing attackers to crash worker processes and execute remote code. This flaw, which has been quietly exploitable since March 2011 due to the introduction of regex support in the map directive, was reported by security researcher Stan Shaw and has prompted the release of patches by F5 SIRT. The patches address the issue in NGINX versions 1.30.4 and 1.31.3, as well as in NGINX Plus versions R36 P7 and 37.0.3.1.

The vulnerability stems from a missing save and restore process of the PCRE capture state within NGINX's internal script engine. This results in a mismatch between buffer size measurements and data writing, creating a window for attackers to exploit the system. The exploitation involves using a leak request, multiple spray connections, and an overflow-triggering request, achieving reliable remote code execution with full ASLR enabled on systems like Ubuntu 24.04.

This vulnerability is not limited to a single directive but affects at least 13 call sites across various source files, impacting both HTTP and stream modules. Any configuration using a regex capture source combined with a regex-based map variable in the same request context could be vulnerable. Notably, recent patches for other NGINX vulnerabilities do not address this issue, leaving many systems unprotected.

A static configuration scanner has been released on GitHub to help administrators identify vulnerable directive orderings without executing any exploits. This proactive measure allows organizations to audit their systems promptly while the full proof-of-concept remains withheld for 21 days following the patch release. This delay aims to give administrators sufficient time to secure their systems against potential threats.