franklinf25/cve-2026-42533Exploit code for CVE-2026-42533, providing proof-of-concept implementation for the specified vulnerability.
Full-chain security research on CVE-2026-42533 (CVSS 4.0 9.2
CRITICAL): a heap buffer overflow in NGINX's script engine where a
regex-based map clobbers the shared capture state between the length
and copy passes of a complex-value evaluation — reachable
pre-authentication on both the HTTP and stream (TLS SNI) surfaces.
Result: pre-auth remote code execution (system() as the worker
user) in a pinned lab, reproduced 3/3 — plus an independent
HTTP-module research chain that maps the bug's primitives from root
cause to deterministic worker compromise.
| Claim | Evidence |
|---|
| Root cause derived from the fix commits (not from blogs) | finding-sheet |
| Safe detector: vulnerable vs patched oracle, zero crashes | poc/diagnose.py (divergence served vs 500 no buffer space) |
| Deterministic worker DoS (heap-corruption abort, core dump) | poc/crash.py — 2/2, X-Worker-PID change proves worker death |
| Arbitrary-byte overflow incl. NULs (pointer-capable write) | HTTP body-map primitive, raw-upstream dump verified |
| Pre-auth RCE, ASLR defeated at runtime (no lab crutches) | exploit/stream_rce.py — 3/3, leak + spray + session rebuild |
# stream variant: the full chain (build is a pinned nginx rev, ~3 min)
cd lab/stream && docker compose up -d --build && cd ../..
python3 exploit/stream_rce.py --host 127.0.0.1 --port 29443 \
--cmd 'echo pwned-by-cve-2026-42533 > /tmp/proof'
docker compose -f lab/stream/docker-compose.yml exec nginx-rce cat /tmp/proof
# HTTP variant: deterministic crash PoC + safe detector
cd lab && docker compose up -d --build && cd ..
python3 poc/crash.py 127.0.0.1 8080 # worker aborts, core dumped
python3 poc/diagnose.py 127.0.0.1 8080 # VULNERABLE / PATCHED oracle
| Doc | What it is |
|---|---|
| docs/finding-sheet.md | One-page datasheet: versions, CVSS, config patterns, detection signatures |
| docs/report-ptes.md | Full PTES-structured report (7 phases) with lab evidence |
| docs/research-writeup.md | The investigation narrative — methodology, dead ends, portable lessons, prior-work comparison |
The HTTP-module research chain is original work: the asymmetric lengths/values script compilation measured empirically, the three-copies value-pass law, the NUL-preserving body-map primitive, and the allocator abort-chain forensics. The completed stream-variant RCE follows the published approach of DepthFirst Disclosures (a credited reporter) with attribution — see the writeup's Prior work section for the technique-by-technique comparison of both chains.
This repo shares its methodology with
CVE-2026-42945 — NGINX Rewrite Heap Overrun: Analysis & Deterministic DoS
(sibling repo): the same two-pass length/value bug class in the nginx
script engine, reached there through rewrite/is_args — differential
detector plus deterministic worker DoS, with the RCE question left open.
docs/ finding sheet · PTES report · research writeup
poc/ diagnose.py (safe oracle) · crash.py (deterministic DoS)
exploit/
stream_rce.py full RCE chain (leak → spray → session rebuild → system)
exploit.py HTTP-module chain (research artifact, near-closure)
lab/ HTTP lab (vulnerable 1.31.2 + patched 1.31.3, backends)
lab/stream/ pinned-build lab for the stream variant
b767540, a8289aa, 0cca8e0Educational research artifact. Run only against systems you own or are explicitly authorized to test. The vulnerability is patched — upgrade nginx to ≥ 1.30.4 / ≥ 1.31.3.