CVE-2026-42533

Executive Summary

CVE-2026-42533 is a high-severity heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source. The flaw resides in the map directive when regex matching is combined with string expressions that reference regex capture variables before the map output variable. Under specific conditions, an unauthenticated attacker can trigger a heap overflow by sending crafted HTTP requests, leading to a denial-of-service (DoS) via worker process restart or, in environments with ASLR disabled or bypassed, potential arbitrary code execution. This is a data plane issue only, with no control plane exposure. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: High – Exploitation can cause service disruption and, under specific conditions, code execution.

Deep Dive & Mechanics

The vulnerability is triggered when an NGINX configuration uses a map directive with regex matching. The map directive allows mapping input values to output values based on patterns. When a string expression references the map's regex capture variables (e.g., $1, $2) before referencing the map output variable, a heap buffer overflow can occur. Additionally, using a non-cacheable variable in a string expression under certain conditions can produce the same result.

The root cause is improper memory management during the evaluation of regex captures and string expressions. The heap overflow corrupts adjacent memory, potentially leading to worker process crashes or, if ASLR is disabled or bypassed, code execution. The attacker must send crafted HTTP requests that trigger the vulnerable code path, but conditions beyond their control (e.g., specific configuration patterns) are required.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code pattern involves:

map $http_user_agent $output {
    ~*firefox $1;
    default $output;
}

In this example, $1 references a regex capture variable before $output is defined. The patched code would need to ensure that regex capture variables are not used in string expressions before the map output variable is referenced, or that memory allocation is properly bounded.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate exploitation in a lab:

1. Set up an NGINX instance with a vulnerable configuration:

   http {
       map $http_user_agent $output {
           ~*firefox $1;
           default $output;
       }
       server {
           listen 80;
           location / {
               return 200 "$output";
           }
       }
   }
   

2. Send crafted HTTP requests with a User-Agent header that triggers the regex capture:

   curl -H "User-Agent: firefoxAAAA...AAAA" http://target/
   

   The payload should be long enough to cause a heap overflow (e.g., 10,000+ characters).
3. Monitor the NGINX worker process for crashes or restarts.

Blue Team

• Monitor NGINX worker process restarts and logs for unusual patterns.
• Use memory protection mechanisms (ASLR, DEP) to mitigate code execution.
• Implement rate limiting and input validation to reduce attack surface.

Indicators of Compromise (IOCs)

• Network: HTTP requests with unusually long User-Agent headers containing regex-triggering patterns (e.g., "firefox" followed by many characters).
• System: NGINX worker process crashes or restarts without apparent cause.
• Logs: NGINX error logs showing "heap buffer overflow" or "segmentation fault" messages.
• Memory: Abnormal memory usage patterns in NGINX worker processes.

Detection Engineering

YARA Rule

rule nginx_heap_overflow_cve_2026_42533 {
    meta:
        description = "Detects NGINX heap overflow exploitation attempts via User-Agent"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-42533"
    strings:
        $pattern = /firefox.{1000,}/i
    condition:
        $pattern
}

Sigma Rule

title: NGINX Heap Overflow Attempt via User-Agent
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with long User-Agent headers targeting NGINX map directive
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.user_agent|contains: "firefox"
        http.user_agent|length: >= 1000
    condition: selection
falsepositives:
    - Legitimate long User-Agent strings
level: high

Suricata Rule

alert http any any -> any any (msg:"NGINX Heap Overflow Attempt via User-Agent"; flow:to_server; content:"firefox"; http_user_agent; byte_test:1,>,1000,0,string,dec; reference:cve,2026-42533; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable regex capture variable usage in map directives until a patch is available. Use alternative configuration patterns.
• Short-term: Apply memory protection (ASLR, DEP) and monitor for worker process crashes.
• Long-term: Apply the official patch from NGINX when released. Upgrade to a patched version.
• Workaround: Avoid using regex captures in map directives that reference the map output variable. Use if blocks or other directives instead.

Valters IT