Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42533 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… | 9.2 | <1% | PoC ×2 | |
| CVE-2026-42945 | Heap Buffer Overflow in NGINX Plus & Open Source rewrite module — DoS, potential RCE | 9.2 | 68% | PoC ×5 | |
| CVE-2026-9256 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module | 9.2 | 11% |
From the original article
4 min read at thehackernews.com
F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1. 30.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.