CVE

CVE-2026-42533

View on NVD ↗

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a he

MITRE ATT&CK TTPs 4

T1055
Process Injection
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1071.003
Mail Protocols
Command And Control
 T1203
Exploitation for Client Execution
Execution

Source Articles

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities, including potential remote code execution (RCE) and a TLS session forgery flaw that could bypass client-certificate checks. The most severe flaws are heap overflows and a use-after-free condition, exploitable under specific configurations involving alias with rewrite, regex maps, AIO with SSI, or shared TLS session caches. The TLS flaw (CVE-2026-97629) stems from improper rotation of session ticket keys, allowing non-deterministic forged session resumption. No active exploitation has been reported, but prior NGINX flaws have seen rapid weaponization post-disclosure.
hacker-news Oct 15, 2026