F5 patched a critical nginx vulnerability that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 sits in nginx's script engine, the code that builds strings from configuration directives at request time, and only surfaces under a specific configuration: a regex based map whose output is referenced in a string expression after an earlier regex capture. Under that pattern the engine's two pass evaluation disagrees on buffer size. Triggering it crashes or restarts the worker, and F5 says code execution may be possible where address randomization is disabled or bypassed. Fixes shipped July 15.
An AI-discovered bug hidden in NGINX since 2008 lets anyone on the internet crash NGINX worker processes or, with ASLR disabled, run code on the server using a single crafted HTTP request. The flaw, named NGINX Rift (CVE-2026-42945, CVSS 9.2), sits in the rewrite module that powers URL rewriting in almost every NGINX deployment. It triggers when a config uses a rewrite directive with unnamed regex captures and a question mark, followed by another rewrite, if, or set directive - a common pattern in API gateway setups. NGINX runs roughly a third of the websites on the public internet.
TrustStrike Labs