NGINX Plus: critical vulnerability

NGINX Plus

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

Do this now

Review nginx map directives that use regex captures and restrict exposure until a vendor fix is released.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 22:17 UTC
Identifiers: CVE-2026-42533
CVSS: 9.2
Source: news
On the menu as: nginx

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## NGINX Plus: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: NGINX Plus
Ids: CVE-2026-42533

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

## Steps
1. This touches infrastructure (nginx). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. There is no fix yet. Until one ships: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-42533") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://my.f5.com/manage/s/article/K000162097 https://nvd.nist.gov/vuln/detail/CVE-2026-42533
https://pwned.coffee/i/nginx-plus-critical-vulnerability-cve-2026-42533

Timeline

23 Oct 2026, 22:17 UTC
Proof-of-concept code for CVE-2026-42533 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee