Critical NGINX CVE-2026-42533 Flaw Enables Pre-Authentication Remote Code Execution

A newly disclosed critical security vulnerability in the NGINX Stream module is raising serious concerns for organizations operating internet-facing TCP and UDP proxy services.

Tracked as CVE-2026-42533, the flaw is a pre-authentication heap buffer overflow that could allow unauthenticated remote attackers to crash NGINX worker processes and potentially achieve arbitrary code execution.

Assigned a CVSS v4.0 score of 9.2, the vulnerability affects a broad range of NGINX Open Source releases from version 0.9.6 through 1.31.2, as well as NGINX Plus versions prior to 37.0.3.1 and R36 P7, making it one of the most significant NGINX security issues disclosed this year.

Critical NGINX CVE-2026-42533 Flaw

The vulnerability exists within the Stream module’s script engine, specifically in the ngx_stream_script_copy_capture_code() function located in ngx_stream_script.c.

This function is responsible for copying regular expression capture groups during the evaluation of complex values used in stream-level directives.

Researchers found that the flaw stems from a mismatch between NGINX’s buffer size calculation and the actual amount of data copied into memory, creating a classic heap buffer overflow condition.

Since the flaw can be triggered before authentication or TLS session establishment, internet-exposed systems are particularly vulnerable.

The issue primarily affects deployments using the ssl_preread module, a feature designed to inspect incoming TLS ClientHello packets before encrypted communication begins.

The module extracts metadata such as the Server Name Indication (SNI), enabling administrators to make routing decisions without terminating TLS connections.

These extracted values can then be referenced within stream configuration directives, including map and return statements, allowing dynamic traffic routing based on hostname information.

However, when these variables are processed as complex values involving regular expression captures, the vulnerability can be triggered.

According to the technical analysis, NGINX’s Stream module relies on a two-pass processing mechanism when evaluating complex values. During the first pass, the engine calculates the amount of memory required to store the resulting value. In the second pass, it copies the actual data into the allocated buffer.

The flaw occurs because evaluating a regex-based variable between these two stages modifies the global PCRE capture state.

As a result, the calculated buffer size no longer matches the updated capture data, causing the copy operation to write more bytes than the allocated memory can safely hold.

Researchers noted that this type of two-pass state inconsistency has become a recurring security weakness within NGINX’s scripting architecture.

Earlier this year, a similar vulnerability known as “Nginx Rift” (CVE-2026-42945) affected the HTTP Rewrite module, where changes in the internal script engine state between length calculation and data copying resulted in comparable heap corruption.

The discovery of CVE-2026-42533 suggests that similar architectural patterns may exist across multiple NGINX scripting components, emphasizing the need for careful review of memory handling logic throughout the codebase.

An attacker can exploit the vulnerability by targeting an NGINX Stream listener configured with ssl_preread enabled alongside a regular expression-based map directive referencing $ssl_preread_server_name.

If a return directive subsequently combines both a regex capture group and the mapped variable, the attacker can send a specially crafted TLS ClientHello packet containing an oversized SNI hostname.

This malformed input forces the script engine to calculate a smaller buffer during the initial processing phase while the updated capture state causes substantially more data to be copied during the second phase, resulting in heap memory corruption before the TLS handshake completes.

Security researcher Markakd successfully validated the vulnerability using an AddressSanitizer-enabled NGINX build with the stream_ssl_preread_module activated.

The proof-of-concept attack utilized a Python script that transmitted a TLS ClientHello message containing a 1,000-byte SNI hostname. The target server was configured with a regex-based map directive and a return statement referencing both captured and mapped values.

Testing confirmed a heap buffer overflow write extending one byte beyond a 256-byte heap allocation, with the overflow originating directly from the memcpy() operation inside ngx_stream_script_copy_capture_code().

Although no public evidence currently indicates active exploitation, the combination of pre-authentication access, network-based attack vector, and potential remote code execution significantly increases the severity of the vulnerability.

Security teams should immediately review NGINX Stream configurations for regex-based map directives operating on preread variables, particularly those using ssl_preread_server_name.

Administrators are advised to minimize exposure of affected stream listeners, monitor systems for unusual crashes or memory corruption indicators, and apply official NGINX security updates as soon as they become available.

Given the similarity to previous script engine flaws, organizations should also conduct broader configuration audits to identify other complex value processing patterns that may introduce comparable security risks.