CVE-2026-42533
A flaw in NGINX Plus and NGINX Open Source lets attackers send specially crafted requests that trigger a heap buffer overflow in the worker process. The overflow can crash the server, causing a denial‑of‑service, and may even allow code execution when Address Space Layout Randomization is disabled.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
NGINX Plus and NGINX Open Source web servers, regardless of version, used by anyone running an NGINX instance.
Real-world impact
An attacker can cause the NGINX worker process to crash, bringing the web server down. If ASLR is disabled or bypassed, the attacker may also run arbitrary code on the host.
Why this severity
The CVSS score of 9.2 reflects the high impact of a denial‑of‑service or potential code execution, the lack of authentication or user interaction required, and the high complexity of the attack vector.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 15, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.