[{"data":1,"prerenderedAt":500},["ShallowReactive",2],{"switcher-blog-pareja":3,"art-nginx-cve-2026-42533-critical-heap-overflow-en":6},{"en":4,"es":5},"\u002Fen\u002Fblog\u002Fnginx-cve-2026-42533-critical-heap-overflow\u002F","\u002Fes\u002Fblog\u002Fnginx-cve-2026-42533-desbordamiento-critico\u002F",{"id":7,"title":8,"author":9,"body":10,"date":485,"description":486,"extension":487,"image":488,"meta":489,"navigation":297,"pareja":490,"path":491,"seo":492,"stem":493,"tags":494,"__hash__":499},"blogEn\u002Fen\u002Fblog\u002Fnginx-cve-2026-42533-critical-heap-overflow.md","Nginx patches a critical heap overflow dating back to 2011: CVE-2026-42533 and the exploit countdown","Paco Cubel",{"type":11,"value":12,"toc":470},"minimark",[13,18,35,50,54,65,69,80,92,96,99,132,135,139,162,171,175,178,183,205,224,228,336,350,368,375,378,409,412,416,419,428,431,435,466],[14,15,17],"h2",{"id":16},"fifteen-years-in-the-code","Fifteen years in the code",[19,20,21,22,26,27,30,31,34],"p",{},"Some patches close a bug from the latest release, and some close a bug that's been sitting there for ",[23,24,25],"strong",{},"fifteen years",". This one is the second kind: the buffer overflow tracked as ",[23,28,29],{},"CVE-2026-42533"," is present in every Nginx version since 0.9.6, released in ",[23,32,33],{},"2011",". In other words: if you run Nginx in production, it barely matters when you installed it — it was affected.",[19,36,37,38,41,42,45,46,49],{},"On July 15th F5 published the versions that fix it: ",[23,39,40],{},"1.30.4"," (stable), ",[23,43,44],{},"1.31.3"," (mainline) and ",[23,47,48],{},"NGINX Plus 37.0.3.1",". And it doesn't travel alone: the same batch closes two more vulnerabilities worth knowing about.",[14,51,53],{"id":52},"in-one-sentence","In one sentence",[19,55,56,57,60,61,64],{},"A crafted HTTP request can trigger a ",[23,58,59],{},"heap buffer overflow"," in the Nginx worker process. In the attacker's second-best scenario it crashes the worker and causes denial of service; in their best one — on systems without ASLR, or where it can be bypassed — it may escalate to ",[23,62,63],{},"remote code execution",". CVSS 9.2 on the v4 scale (8.1 on v3.1, reflecting the high attack complexity).",[14,66,68],{"id":67},"what-we-know-about-the-flaw","What we know about the flaw",[19,70,71,72,75,76,79],{},"The overflow happens in Nginx's expression-evaluation engine when processing specially constructed HTTP requests. The fine details are deliberately unpublished: the researcher who reported it, Stan Shaw, has announced he will release his ",[23,73,74],{},"proof of concept 21 days after the patch"," — that is, in ",[23,77,78],{},"early August",".",[19,81,82,83,86,87,91],{},"That \"you get three weeks\" model is increasingly common, and you should read it for what it is: ",[23,84,85],{},"a countdown",". Today there's no public exploit and no evidence of active exploitation (it's not in CISA's KEV catalog as of this article). But the day the PoC drops, automated scanners take hours to pick it up, not weeks. The comfortable window to update is ",[88,89,90],"em",{},"now",", not August.",[14,93,95],{"id":94},"what-ships-in-the-same-batch","What ships in the same batch",[19,97,98],{},"Versions 1.30.4 and 1.31.3 also fix:",[100,101,102,118],"ul",{},[103,104,105,108,109,113,114,117],"li",{},[23,106,107],{},"CVE-2026-60005"," — memory disclosure in ",[110,111,112],"code",{},"ngx_http_slice_module",". If you use the ",[110,115,116],{},"slice"," module (typical in caching setups for video or large chunked files), a crafted response can leak worker memory contents.",[103,119,120,121,127,128,131],{},"A ",[23,122,123,124],{},"use-after-free in ",[110,125,126],{},"ngx_http_ssi_module",", the Server Side Includes module. Fewer people use it these days, but if some inherited config still has ",[110,129,130],{},"ssi on;",", this one's for you too.",[19,133,134],{},"Three flaws, one package. All the more reason not to let it slide.",[14,136,138],{"id":137},"whos-affected","Who's affected",[100,140,141,150,156],{},[103,142,143,146,147,79],{},[23,144,145],{},"Affected versions",": 0.9.6 through 1.31.2. In practice, ",[23,148,149],{},"every Nginx without the July 15th patch",[103,151,152,155],{},[23,153,154],{},"Highest exposure",": any internet-facing Nginx — which is exactly where Nginx tends to live. The attack complexity is high, but the attack surface is universal.",[103,157,158,161],{},[23,159,160],{},"NGINX Plus",": equally affected; the fix is in 37.0.3.1.",[19,163,164,165,170],{},"If you applied ",[166,167,169],"a",{"href":168},"\u002Fen\u002Fblog\u002Fnginx-cve-batch-may-2026","May's batch of seven CVEs"," and figured you were up to date: you were. Until now. That's how this works.",[14,172,174],{"id":173},"what-you-need-to-do-today","What you need to do today",[19,176,177],{},"The usual routine — no drama, and no leaving it for later.",[179,180,182],"h3",{"id":181},"_1-check-what-version-youre-running","1. Check what version you're running",[184,185,190],"pre",{"className":186,"code":187,"language":188,"meta":189,"style":189},"language-bash shiki shiki-themes github-dark-high-contrast","nginx -v\n","bash","",[110,191,192],{"__ignoreMap":189},[193,194,197,201],"span",{"class":195,"line":196},"line",1,[193,198,200],{"class":199},"s_sBn","nginx",[193,202,204],{"class":203},"sCcAr"," -v\n",[100,206,207,216],{},[103,208,209,212,213,79],{},[23,210,211],{},"Stable"," branch: the target is ",[23,214,215],{},"1.30.4 or higher",[103,217,218,212,221,79],{},[23,219,220],{},"Mainline",[23,222,223],{},"1.31.3 or higher",[179,225,227],{"id":226},"_2-update-and-reload-zero-downtime","2. Update and reload (zero downtime)",[184,229,231],{"className":186,"code":230,"language":188,"meta":189,"style":189},"# Debian \u002F Ubuntu\nsudo apt update && sudo apt install --only-upgrade nginx\nsudo nginx -t && sudo systemctl reload nginx\n\n# RHEL \u002F AlmaLinux \u002F Rocky\nsudo dnf update nginx\nsudo nginx -t && sudo systemctl reload nginx\n",[110,232,233,239,269,292,299,305,317],{"__ignoreMap":189},[193,234,235],{"class":195,"line":196},[193,236,238],{"class":237},"sQrFR","# Debian \u002F Ubuntu\n",[193,240,242,245,249,252,256,258,260,263,266],{"class":195,"line":241},2,[193,243,244],{"class":199},"sudo",[193,246,248],{"class":247},"sTRMh"," apt",[193,250,251],{"class":247}," update",[193,253,255],{"class":254},"sMAXC"," && ",[193,257,244],{"class":199},[193,259,248],{"class":247},[193,261,262],{"class":247}," install",[193,264,265],{"class":203}," --only-upgrade",[193,267,268],{"class":247}," nginx\n",[193,270,272,274,277,280,282,284,287,290],{"class":195,"line":271},3,[193,273,244],{"class":199},[193,275,276],{"class":247}," nginx",[193,278,279],{"class":203}," -t",[193,281,255],{"class":254},[193,283,244],{"class":199},[193,285,286],{"class":247}," systemctl",[193,288,289],{"class":247}," reload",[193,291,268],{"class":247},[193,293,295],{"class":195,"line":294},4,[193,296,298],{"emptyLinePlaceholder":297},true,"\n",[193,300,302],{"class":195,"line":301},5,[193,303,304],{"class":237},"# RHEL \u002F AlmaLinux \u002F Rocky\n",[193,306,308,310,313,315],{"class":195,"line":307},6,[193,309,244],{"class":199},[193,311,312],{"class":247}," dnf",[193,314,251],{"class":247},[193,316,268],{"class":247},[193,318,320,322,324,326,328,330,332,334],{"class":195,"line":319},7,[193,321,244],{"class":199},[193,323,276],{"class":247},[193,325,279],{"class":203},[193,327,255],{"class":254},[193,329,244],{"class":199},[193,331,286],{"class":247},[193,333,289],{"class":247},[193,335,268],{"class":247},[19,337,338,339,342,343,346,347,349],{},"The ",[110,340,341],{},"nginx -t"," before the ",[110,344,345],{},"reload"," validates your configuration and spares you the scare of a service down over a typo. The ",[110,348,345],{}," swaps in the new binary without dropping in-flight connections.",[351,352,353],"blockquote",{},[19,354,355,356,359,360,363,364,367],{},"Remember the distro-repository caveat: they sometimes backport the fix ",[23,357,358],{},"while keeping the old version number",". If your ",[110,361,362],{},"nginx -v"," doesn't reach 1.30.4 but the package was built after July 15th, check your distro's security changelog before panicking — and the other way round: don't assume you're covered just because you ran ",[110,365,366],{},"apt upgrade"," last week.",[179,369,371,372,374],{"id":370},"_3-if-you-use-slice-or-ssi","3. If you use ",[110,373,116],{}," or SSI",[19,376,377],{},"Take the chance to confirm it:",[184,379,381],{"className":186,"code":380,"language":188,"meta":189,"style":189},"nginx -T 2>\u002Fdev\u002Fnull | grep -E \"slice|ssi on\"\n",[110,382,383],{"__ignoreMap":189},[193,384,385,387,390,394,397,400,403,406],{"class":195,"line":196},[193,386,200],{"class":199},[193,388,389],{"class":203}," -T",[193,391,393],{"class":392},"sWyjQ"," 2>",[193,395,396],{"class":247},"\u002Fdev\u002Fnull",[193,398,399],{"class":392}," |",[193,401,402],{"class":199}," grep",[193,404,405],{"class":203}," -E",[193,407,408],{"class":247}," \"slice|ssi on\"\n",[19,410,411],{},"If anything shows up, those two secondary flaws applied to you as well — and the patch closes them in one go.",[14,413,415],{"id":414},"what-we-did","What we did",[19,417,418],{},"On the 15th itself we updated the internet-facing Nginx instances we manage, starting with the exposed reverse proxies. Without waiting for the PoC, without waiting for it to show up in CISA's KEV: when a flaw has spent fifteen years in the code, affects every version and has an announced public-exploit date, the cost\u002Fbenefit math on updating is already done.",[19,420,421,422,424,425,427],{},"And after the ",[110,423,345],{},", the gesture that separates \"I think it's done\" from \"it's done\": running ",[110,426,362],{}," again and checking. Memory verifies nothing.",[19,429,430],{},"If your Nginx hasn't seen a patch in months — or you don't even know what version it runs — let's talk.",[14,432,434],{"id":433},"references","References",[100,436,437,445,452,459],{},[103,438,439],{},[166,440,444],{"href":441,"rel":442},"https:\u002F\u002Fnginx.org\u002Fen\u002Fsecurity_advisories.html",[443],"nofollow","nginx security advisories — nginx.org",[103,446,447],{},[166,448,451],{"href":449,"rel":450},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcritical-nginx-vulnerability-can-crash.html",[443],"Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution — The Hacker News",[103,453,454],{},[166,455,458],{"href":456,"rel":457},"https:\u002F\u002Fmy.f5.com\u002Fmanage\u002Fs\u002Farticle\u002FK000161019",[443],"NGINX vulnerability CVE-2026-42533 — F5 (K000161019)",[103,460,461],{},[166,462,465],{"href":463,"rel":464},"https:\u002F\u002Fdocs.nginx.com\u002Fnginx\u002Freleases\u002F",[443],"Releases — NGINX Documentation",[467,468,469],"style",{},"html pre.shiki code .s_sBn, html code.shiki .s_sBn{--shiki-default:#FFB757}html pre.shiki code .sCcAr, html code.shiki .sCcAr{--shiki-default:#91CBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sQrFR, html code.shiki .sQrFR{--shiki-default:#BDC4CC}html pre.shiki code .sTRMh, html code.shiki .sTRMh{--shiki-default:#ADDCFF}html pre.shiki code .sMAXC, html code.shiki .sMAXC{--shiki-default:#F0F3F6}html pre.shiki code .sWyjQ, html code.shiki .sWyjQ{--shiki-default:#FF9492}",{"title":189,"searchDepth":241,"depth":241,"links":471},[472,473,474,475,476,477,483,484],{"id":16,"depth":241,"text":17},{"id":52,"depth":241,"text":53},{"id":67,"depth":241,"text":68},{"id":94,"depth":241,"text":95},{"id":137,"depth":241,"text":138},{"id":173,"depth":241,"text":174,"children":478},[479,480,481],{"id":181,"depth":271,"text":182},{"id":226,"depth":271,"text":227},{"id":370,"depth":271,"text":482},"3. If you use slice or SSI",{"id":414,"depth":241,"text":415},{"id":433,"depth":241,"text":434},"2026-07-16","Nginx just shipped security releases closing a buffer overflow present in every version since 2011, rated CVSS 9.2. There's no public exploit today, but the researcher who found it has already set a date to release one. Here's who's affected, what else gets fixed in the same batch and how to update with zero downtime.","md","\u002Fog\u002Fog-default.png",{},"nginx-cve-2026-42533-desbordamiento-critico","\u002Fen\u002Fblog\u002Fnginx-cve-2026-42533-critical-heap-overflow",{"title":8,"description":486},"en\u002Fblog\u002Fnginx-cve-2026-42533-critical-heap-overflow",[495,496,497,498],"Nginx","Servers","Security","CVE","QbbJ201k99rqEcycly2MD-D-5Ptmg5fAg5Z76tGK86I",1784782834741]