CVE-2026-42533 is a critical vulnerability in NGINX Plus and NGINX Open Source related to the map directive's handling of regex matching and string expressions referencing regex capture variables before the map output variable. Exploitation by unauthenticated attackers sending crafted HTTP requests can cause a heap buffer overflow in the NGINX worker process, resulting in a denial-of-service via process restart or potential code execution on systems with ASLR disabled or bypassed. The vulnerability affects versions prior to 1.30.4-2.hum1 and certain versions between 1.31.0 and 1.31.3, including Red Hat Hardened Images. Red Hat has released updated packages to fix this issue.

Remote attackers can cause denial-of-service conditions by triggering heap buffer overflows that crash NGINX worker processes. On systems with ASLR disabled or where ASLR can be bypassed, attackers may achieve remote code execution. There is no exposure of control plane components; the impact is limited to the data plane. This vulnerability can disrupt service availability and potentially compromise system integrity.

A patch is available and should be applied promptly. Red Hat has released updated RPM packages for Red Hat Hardened Images including nginx-1.30.4-2.hum1 and related modules. Users should update to these fixed versions to remediate the vulnerability. No alternative mitigations are specified beyond applying the official fix.