CVE-2026-42533 — nginx map/regex capture clobbering tracking site

Patch-status tracker for CVE-2026-42533, a heap buffer overflow in nginx's two-pass script evaluation engine. nginx measures a string expression in a LEN pass and writes it in a VALUE pass without saving and restoring the PCRE capture state, so evaluating a regex map clobbers a capture referenced earlier in the same expression and the two passes disagree on the buffer size. An unauthenticated attacker can send crafted HTTP requests to overflow the worker's heap with request-controlled bytes; F5 rates the impact as denial of service, and code execution where ASLR is disabled or can be bypassed. Fixed upstream in nginx 1.31.3 (mainline) and 1.30.4 (stable), released 2026-07-15.

The rendered site is published at https://kimmo.cloud/CVE-2026-42533/. Deployment plan and current setup state live in WEBSITE.md.

Source of truth

The tracker is a single Hugo page: site/content/_index.md. Edit that file; everything else is build infrastructure.

It carries two distribution tables with identical columns — one per upstream nginx track, since stable and mainline have separate fixed releases (1.30.4 and 1.31.3) and distributions package them separately.

Local development

Requires Hugo extended (≥ 0.146.0) and Go (for Hugo Modules to fetch the PaperMod theme).

With Nix (recommended)

nix develop          # dev shell: hugo, go, git, resvg, curl
cd site
hugo server          # local preview at http://localhost:1313/CVE-2026-42533/

If you use direnv, direnv allow once and the dev shell auto-activates whenever you cd into the repo.

Without Nix

Install Hugo extended ≥ 0.146.0 and Go ≥ 1.24 yourself, then:

cd site
hugo server          # http://localhost:1313/CVE-2026-42533/

Build and publish

make build       # local build into site/public/
make dist        # build, then rsync to haig:/CVE-2026-42533/
make banner      # re-rasterise the social banner SVG → PNG (needs resvg + Roboto)

make dist runs make build first. make banner is only needed after editing site/assets/cve-2026-42533-tracker.svg; the rendered PNG is committed.

Dating a fix

A row's Fixed since is the date the fix actually shipped, derived from the source that shipped it — never the day it was noticed. For the NixOS and nixpkgs channels that derivation is a script:

./scripts/nixos-first-shipped nixos-unstable <nixpkgs-commit>

It lists the channel's published releases, finds the earliest one built from a revision containing the commit, and prints that release and its publication date. Debian dates come from the changelog or snapshot.debian.org, pkgsrc dates from the package Makefile's history.

The other two helpers read the current state out of the local clones:

./scripts/nixpkgs-versions

./scripts/pkgsrc-versions

Each prints one line per tracked row — the versions, and whether a CVE backport is present. pkgsrc-versions honours PKGNAME, so it reports the identifier a host prints (nginx-devel-1.29.6nb1), not the distfile name.

Repo layout

.
├── flake.nix              # Nix dev environment (hugo, go, git, resvg, curl)
├── .envrc                 # direnv hook → `use flake`
├── .gitignore
├── Makefile               # `make build`, `make dist`, `make banner`
├── LICENSE                # CC BY 4.0
├── README.md              # this file
├── CLAUDE.md              # project instructions for Claude Code
├── WEBSITE.md             # publication plan / decisions log
├── scripts/               # auto-update driver + prompt, and the three lookup helpers
├── systemd/               # user-level timer + service units
└── site/                  # Hugo project
    ├── hugo.toml
    ├── content/
    │   └── _index.md      # the tracker (single page)
    ├── assets/css/extended/custom.css      # PaperMod CSS overrides
    ├── assets/cve-2026-42533-tracker.svg   # social-banner source (→ make banner)
    ├── static/cve-2026-42533-tracker.png   # rendered OpenGraph banner (committed)
    ├── layouts/partials/  # PaperMod overrides (post_meta, extend_footer)
    ├── go.mod, go.sum     # Hugo Modules — pulls PaperMod theme
    └── …                  # standard Hugo skeleton

License

CC BY 4.0 — share and adapt with attribution.