Orca Security: Critical Heap Buffer Overflow in NGINX Allows Unauthenticated RCE

What it is

CVE-2026-42533 is a heap buffer overflow (CWE-122) in the regex handling of NGINX's map directive. It affects NGINX Open Source and NGINX Plus. It is rated CVSS v4.0 9.2 and CVSS v3.1 8.1. F5 fixed it in the same advisory as two other high-severity NGINX bugs.

How it works

The overflow occurs when a string expression references unnamed regex captures before the map output variable. An unauthenticated attacker sends crafted HTTP requests to a server whose config uses map with regex matching. The result is a heap overflow in the worker process. That restarts workers (DoS), and it may give code execution where ASLR is disabled or bypassed.

Preconditions / Affected

• The config must use map with regex matching and unnamed captures. The page doesn't say which config patterns are safe beyond the named-capture mitigation.
• NGINX Open Source 0.9.6 through 1.31.2.
• NGINX Plus before 37.0.3.1 and before R36 P7.
• NGINX Ingress Controller 3.5.0–3.7.2, 4.0.0–4.0.1 and 5.0.0–5.4.2.
• NGINX App Protect WAF 4.9.0–4.16.0 and 5.1.0–5.8.0.
• NGINX Instance Manager 2.16.0–2.22.0.
• NGINX Gateway Fabric: the page lists only "various 1.x and 2.x versions".

Containerized and Kubernetes deployments (ingress, reverse proxy, load balancer) are called out as especially exposed.

What to do

• Upgrade NGINX Open Source to 1.31.3 (mainline) or 1.30.4 (stable).
• Upgrade NGINX Plus to 37.0.3.1 or R36 P7.
• Update Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager to their patched versions. The page doesn't give those version numbers, so check the F5 advisory.
• As a temporary mitigation for CVE-2026-42533 and CVE-2026-60005, switch map regexes to named captures. The page gives no config example.

The same advisory fixes two further bugs:

A separate BIG-IP HTTP/2 memory exhaustion issue was also addressed in the advisory.

Caveats

• The page says no public PoC and no in-the-wild exploitation had been reported at the time of writing.
• Because 1.31.3 and 1.30.4 are the fixed releases, a workaround-only posture still leaves CVE-2026-56434 open.
• The page's remediation advice for its own product is Orca scanning, which is vendor promotion rather than extra technical detail.