CVE-2026-42533 nginx heap buffer overflow PoC (pre-auth RCE via two-pass capture clobbering)

What it is

A public GitHub PoC (imbas007/CVE-2026-42533, page dated 2026-07-27) for CVE-2026-42533, described as a critical pre-auth heap buffer overflow in nginx's two-pass string evaluation engine. The repo ships a full exploit chain (exploit.py, leak.py, overflow.py, analyze.py), a vulnerable nginx.conf, and a Docker/Ubuntu 24.04 test environment.

How it works

nginx evaluates variable strings in two passes: a LEN pass measures the output to size a buffer, then a VALUE pass writes it. The page claims a regex-based map directive using a numbered capture ($1) silently overwrites the shared r->captures structure between passes. LEN measures the small original capture; a crafted header then clobbers $1 with a large value, so VALUE writes far more than was allocated — the page's example writes 10000 bytes into a 5003-byte buffer, overflowing ~4997 bytes into adjacent heap. A smaller capture instead leaks uninitialized heap memory (libc/heap pointers). Chained, leak + overflow defeat ASLR. The overflow target is ngx_pool_cleanup_t: overwriting its handler function pointer yields RIP control when the pool is destroyed and handler(data) fires.

Preconditions / Affected

• nginx 0.9.6 – 1.30.3 / 1.31.2 (per page).
• The config must combine three things: a regex map that assigns a numbered capture ("~^(.+)$" $1;), a regex location creating captures, and both a capture and the map variable in the same sink directive (e.g. return 200 "$1$overflow_gadget";).
• Named captures are stated to be safe.

What to do

Upgrade to nginx 1.30.4+ (stable) / 1.31.3+ (mainline), or NGINX Plus R36 P7 / 37.0.3.1. As a config mitigation, replace numbered captures with named captures in map directives.

Non-destructive check for the two-pass mismatch (no crash):

python3 exploit/overflow.py <target> --diagnose

Crash test (kills the worker):

python3 exploit/overflow.py <target> --crash

Docker test bed:

docker compose up -d --build
python3 exploit/overflow.py localhost --port 8080 --diagnose

Caveats

Treat all figures as claims from an untrusted PoC page, not verified fact. The repo self-reports "10/10 reliability on Ubuntu 24.04" only; other targets are unstated. The build instructions compile nginx with -O0 debug flags, so demonstrated reliability may not reflect production binaries. The --crash mode is destructive (worker exits on SIGABRT). The affected-version range and patch versions could not be independently confirmed from the page alone — verify against the official nginx advisory before acting.