A heap buffer overflow vulnerability, CVE-2026-42533, exists in NGINX Plus and NGINX Open Source when a 'map' directive uses regex matching and references its capture variables before the map's output variable or uses a non-cacheable variable under certain conditions, allowing an unauthenticated attacker to send crafted HTTP requests causing denial-of-service or remote code execution.
PoC
NGINX Plus +9
vulnerability
nginx
webserver
buffer-overflow
DoS
RCE
3t
2c
updated