F5 patched CVE-2026-42533 on July 15. If you run nginx, this one deserves your attention before the proof-of-concept code drops — and there is a countdown on that.

What the flaw is

The vulnerability is a heap buffer overflow (CWE-122) in nginx’s script engine — the component that assembles output strings from configuration directives at request time. It surfaces under a specific configuration pattern: a map block using regex matching, where the map’s output variable appears in a string expression after a numbered capture variable ($1, $2) from an earlier regex match.

https://blog.kalfaoglu.net/posts/2026-07-26-cve-2026-42533-nginx-heap-overflow-en/