F5 has patched CVE-2026-42533, a stack buffer overflow vulnerability, in NGINX versions 1.30.4 and 1.31.3. The flaw allows attackers to crash server processes by sending specially crafted HTTP requests on servers containing regex-based maps. This can lead to a denial-of-service (DoS) condition. If ASLR is disabled or bypassed, the vulnerability may enable remote code execution.
The vulnerability originates from NGINX's two-stage expression evaluation mechanism. In the first stage, buffer size is calculated; in the second, data is written. The regex evaluation performed between these stages corrupts the shared data state, causing incorrect buffer size calculation. As a result, attacker-controlled data overflows the buffer.
For systems that cannot be updated, F5 recommends converting numbered captures ($1, $2) in regex maps to named captures. However, researcher Stan Shaw notes this mitigation is not fully sufficient, as a second attack vector remains open. The only complete solution is applying NGINX's official updates. This is the third similar stack overflow vulnerability discovered in the past two months. To date, no public exploit has been released.