On July 15, 2026, nginx shipped 1.30.4 (stable) and 1.31.3 (mainline), fixing CVE-2026-42533, a heap buffer overflow rated CVSS 9.2. It needs no authentication: a crafted HTTP request is enough. In a default build the result is a worker process crash and restart — a denial of service — and where ASLR is disabled or can be bypassed, remote code execution becomes possible.

The Trigger: map + regex + capture groups

The root cause isn't the HTTP parser. It sits in nginx's two-pass script evaluation: the pass that computes a length and the pass that writes the value share one set of PCRE capture state. When a map directive containing a regex is evaluated between two references to the same capture group (say $1), that shared state is silently overwritten, the two passes disagree about the buffer size, and the write runs past the end.

In other words, not every nginx is exploitable, but the affected range is enormous: 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline) — most builds shipped since 2011. On the commercial side, NGINX Plus R33–R36 are affected (fixed in R36 P7) and 37.0.0.1–37.0.2.1 are fixed in 37.0.3.1.

Why This Can't Wait

The researcher deliberately held the full write-up and proof of concept for 21 days after the patch to give administrators an upgrade window. That window has closed. Another case from the same year shows how fast weaponisation moves: CVE-2026-42945 — the "Nginx Rift" heap overflow in ngx_http_rewrite_module, patched in May 2026 — was being exploited in the wild roughly a week after the fix landed, with an estimated 5.7 million internet-exposed nginx servers running potentially vulnerable versions. Two comparable bugs in half a year is a good argument against the "install it once and never touch it" web server.

A Three-Step Check

  • Check the version, but don't trust nginx -v alone: Debian and Ubuntu backport security fixes onto the old version string, so a build still reporting 1.24.0 may well be patched. On distro packages, read the package revision from apt policy nginx and confirm the CVE in apt changelog nginx. Only builds from the official nginx repo or compiled by hand should be compared directly against 1.30.4 / 1.31.3.
  • Check whether your config uses map with a regex: grep -rn "map " /etc/nginx/ and look for match entries starting with ~, together with repeated references to capture groups like $1 on the same request path. Without that combination your exposure is far smaller.
  • Check whether workers are restarting silently: grep -i "worker process.*exited on signal" /var/log/nginx/error.log. Repeated signal 11 exits are the classic symptom — and from the visitor's side they look like nothing more than an occasional 502, which is exactly why they get written off as network flakiness.

How to Upgrade

Distro packages: sudo apt update && sudo apt install --only-upgrade nginx, then sudo nginx -t && sudo systemctl reload nginx. Official repo or self-compiled: move to 1.30.4 / 1.31.3 or newer, confirm with nginx -t, then reload. A reload does not drop established connections, so this doesn't need a maintenance window. Worth noting: the same releases also fix CVE-2026-60005 (memory disclosure in ngx_http_slice_module) and CVE-2026-56434 (use-after-free in ngx_http_ssi_module) — three issues cleared in one upgrade.

Treat "I Can Patch This Myself" as a Buying Criterion

How fast you can act on an advisory depends on whether you have root and get to choose when to reload. On shared hosting you wait for the provider's schedule and usually can't even read the full error.log. On your own VPS, ten minutes covers the whole path from advisory to reload. SharkCloud's Japan, Singapore, Hong Kong and US nodes are all independent instances where the OS and web server versions are yours to control — so an advisory gets handled the day it lands, not in the next maintenance window.