CVE-2026–42533: The 15-Year-Old NGINX Bug That Became a Critical RCE

Every so often a vulnerability shows up that isn't the result of sloppy code — it's the result of a design assumption nobody questioned for over a decade. CVE-2026–42533 is exactly that kind of bug.

Buried inside NGINX's own script engine is a two-pass process for building dynamic strings: one pass calculates buffer size, the next pass copies the data. When a regex-based map variable changes state between those two passes, the buffer allocated in pass one no longer matches what pass two tries to write. The result is a heap buffer overflow — CVSS 9.2, Critical — reachable by an unauthenticated attacker sending nothing more than a crafted HTTP request or a malformed TLS ClientHello.

No credentials. No session. No warning signs in your access logs, because the "exploit" isn't an HTTP path string — it's a protocol-level anomaly that classic WAF rules were never built to catch.

Ten days after F5 shipped the patch, a working remote code execution proof-of-concept went public on GitHub. That's the moment this stopped being a "patch when convenient" advisory and became an active-risk situation for every internet-facing NGINX deployment, Kubernetes ingress-nginx controller, and API gateway still running an unpatched build.

In this breakdown, I cover:

→ Exactly how the two-pass buffer allocation bug works, in plain language → A real-world attack scenario using the Stream module and ssl_preread → The log signals and telemetry that actually reveal exploitation attempts → Detection commands and a config scanner to audit your fleet right now → A complete 6-step patch and prevention checklist for SOC and DevSecOps teams

If you're responsible for anything sitting behind NGINX, this is worth ten minutes of your time before the opportunistic scanning starts.

Read the full technical breakdown: https://www.xpert4cyber.com/2026/07/nginx-buffer-overflow-cve-2026-42533.html