CVE-2026-42533 — NGINX Pre-Auth Heap Overflow: Analysis & RCE

Full-chain security research on CVE-2026-42533 (CVSS 4.0 9.2 CRITICAL): a heap buffer overflow in NGINX's script engine where a regex-based map clobbers the shared capture state between the length and copy passes of a complex-value evaluation — reachable pre-authentication on both the HTTP and stream (TLS SNI) surfaces.

Result: pre-auth remote code execution (system() as the worker user) in a pinned lab, reproduced 3/3 — plus an independent HTTP-module research chain that maps the bug's primitives from root cause to deterministic worker compromise.

Verification matrix

Quick start

# stream variant: the full chain (build is a pinned nginx rev, ~3 min)
cd lab/stream && docker compose up -d --build && cd ../..
python3 exploit/stream_rce.py --host 127.0.0.1 --port 29443 \
    --cmd 'echo pwned-by-cve-2026-42533 > /tmp/proof'
docker compose -f lab/stream/docker-compose.yml exec nginx-rce cat /tmp/proof

# HTTP variant: deterministic crash PoC + safe detector
cd lab && docker compose up -d --build && cd ..
python3 poc/crash.py 127.0.0.1 8080          # worker aborts, core dumped
python3 poc/diagnose.py 127.0.0.1 8080      # VULNERABLE / PATCHED oracle

Documents

What is original here vs prior work

The HTTP-module research chain is original work: the asymmetric lengths/values script compilation measured empirically, the three-copies value-pass law, the NUL-preserving body-map primitive, and the allocator abort-chain forensics. The completed stream-variant RCE follows the published approach of DepthFirst Disclosures (a credited reporter) with attribution — see the writeup's Prior work section for the technique-by-technique comparison of both chains.

Companion research

This repo shares its methodology with CVE-2026-42945 — NGINX Rewrite Heap Overrun: Analysis & Deterministic DoS (sibling repo): the same two-pass length/value bug class in the nginx script engine, reached there through rewrite/is_args — differential detector plus deterministic worker DoS, with the RCE question left open.

Repository layout

docs/            finding sheet · PTES report · research writeup
poc/             diagnose.py (safe oracle) · crash.py (deterministic DoS)
exploit/
  stream_rce.py  full RCE chain (leak → spray → session rebuild → system)
  exploit.py     HTTP-module chain (research artifact, near-closure)
lab/             HTTP lab (vulnerable 1.31.2 + patched 1.31.3, backends)
lab/stream/      pinned-build lab for the stream variant

References

• F5 advisory K000162097 · NVD
• Fix series (nginx 1.31.3): b767540, a8289aa, 0cca8e0
• DepthFirst Disclosures — Nginx-Rift (stream variant)

Educational research artifact. Run only against systems you own or are explicitly authorized to test. The vulnerability is patched — upgrade nginx to ≥ 1.30.4 / ≥ 1.31.3.