CVE-2026-42533 nginx

This repository contains a Go-based scanner for identifying nginx configuration patterns associated with the complex_value two-pass capture-clobbering issue described in CVE-2026-42533.

Overview

The tool analyzes nginx configuration files and directories to detect risky configurations where regex captures and regex map variables can share the same request buffer. In such cases, the parser may produce a length/value mismatch that can lead to heap out-of-bounds writes or information disclosure.

Features

• Scans nginx configuration files and directories recursively
• Follows included configuration files by default
• Supports JSON output for automation and downstream tooling
• Reports vulnerable directives and the related capture/map variables
• Provides remediation guidance for identified findings

Requirements

• Go 1.21 or newer

Build

From the project root, run:

go build -o exploit .

Usage

Show help:

./exploit --help

Scan a single configuration file:

./exploit /etc/nginx/nginx.conf

Scan a directory:

./exploit /etc/nginx/

Scan without following includes:

./exploit conf --no-includes

Output JSON:

./exploit conf --json

Exit Codes

• 0: no vulnerabilities found
• 1: vulnerable configuration(s) found
• 2: usage error or no config files found

Project Structure

.
├── images
├── exploit.go
├── go.mod
├── README.md
└── .gitignore

Notes

This project is intended for defensive analysis and security research. Use it responsibly and only on systems you are authorized to assess.