A high-severity heap buffer overflow vulnerability has been recognized within the NGINX Stream module’s script engine. This vulnerability might permit unauthenticated distant attackers to crash employee processes or execute arbitrary code.
The difficulty CVE-2026-42533 impacts configurations that mix the `ssl_preread` function with regex-driven variables and sophisticated values in stream blocks.
NGINX Heap Overflow Flaw
The flaw was discovered within the zplinn/nginx repository, particularly within the file `src/stream/ngx_stream_script.c`, round line 940, within the operate `ngx_stream_script_copy_capture_code()`.
It arises from inconsistent dealing with of standard expression captures throughout NGINX’s two-stage complicated worth analysis course of. First, NGINX calculates the dimensions required for a price after which performs a second move to repeat the evaluated knowledge into the allotted buffer.
If a regex-backed variable modifies the worldwide seize state between these two passes, the copy operation can use a bigger seize than what was anticipated in the course of the size calculation section.
This susceptible situation is especially related for deployments utilizing the Stream module to proxy TCP or UDP companies and examine TLS handshakes earlier than TLS termination.
With `ssl_preread` enabled, NGINX parses chosen ClientHello metadata, together with the Server Identify Indication (SNI), and exposes it by way of variables akin to `$ssl_preread_server_name`.
Directors might use these values in map directives, routing logic, or return statements. A regex analysis involving an unnamed seize, like `$1`, can alter seize knowledge after the vacation spot buffer measurement has already been calculated.
An attacker may exploit this vulnerability by sending a specifically crafted TLS ClientHello that accommodates an outsized SNI worth to an uncovered stream listener. Within the reported proof-of-concept configuration, a regex map evaluates the SNI worth.
On the similar time, the return directive expands each `$1` and a regex-backed variable. Throughout the preliminary move, a small allocation is computed, as reported by Depth First Disclosure.
Nevertheless, the later analysis updates the seize knowledge to mirror a bigger, attacker-controlled SNI string. NGINX then copies this knowledge into an undersized buffer, resulting in an out-of-bounds heap write.
AddressSanitizer output from the proof of idea confirms a heap buffer overflow throughout a 1,000-byte `memcpy` operation in `ngx_stream_script_copy_capture_code()`.
The affected reminiscence area was solely 256 bytes, demonstrating a big write past the allotted heap boundary. Though the provided take a look at primarily reveals a employee course of crash, heap corruption in a network-facing course of may doubtlessly result in arbitrary code execution, relying on allocator habits, construct protections, and the encircling course of reminiscence format.
This vulnerability is especially regarding as a result of it happens earlier than authentication, throughout TLS preread processing. Web-facing NGINX situations configured with regex-based map directives, unnamed captures, complicated stream values, and `ssl_preread` must be prioritized for overview.
This situation is separate from the lately documented fault within the HTTP rewrite module. Nevertheless, each examples spotlight how inconsistent state between the size calculation and replica processes in NGINX’s script engine can result in harmful heap corruption circumstances.
Organizations ought to audit their stream configurations for `ssl_preread`, regex maps, unnamed captures (like `$1`), and directives that mix seize growth with dynamically evaluated variables.
Till an upstream repair is confirmed and deployed, defenders ought to take away unnamed captures from affected complicated values, simplify regex-dependent stream logic, prohibit publicity of TLS preread listeners, and run NGINX employees with present platform hardening measures, akin to Tackle House Format Randomization (ASLR) and least-privilege service accounts.
ALERT: 20+ authorities websites delivered malware to companies and residents. See full assault analysis to verify your individual publicity.
