Skip to content
Threat Feed
Subscribe

Product

NGINX Plus < 37.0.3.1

1 brief RSS
high advisory

CVE-2026-42533 Heap Buffer Overflow in NGINX Map Directive

A heap buffer overflow vulnerability, CVE-2026-42533, exists in NGINX Plus and NGINX Open Source when a 'map' directive uses regex matching and references its capture variables before the map's output variable or uses a non-cacheable variable under certain conditions, allowing an unauthenticated attacker to send crafted HTTP requests causing denial-of-service or remote code execution.

PoC NGINX Plus +9 vulnerability nginx webserver buffer-overflow DoS RCE
3t 2c updated