In a significant update, freenginx and nginx have introduced a new buffer size check to prevent potential buffer overflow vulnerabilities. This move comes after the discovery of three buffer overflow incidents in 2026, with the latest attributed to the mishandling of regular expressions and variables. Developer Maxim Dunin took decisive action to enhance security by ensuring that the size of a variable is checked before data is written into it.
On June 19, a commit was made to freenginx, adding an "end" field to the variable descriptor to mark the buffer's end. Previously, only the starting pointer was available, with the required length calculated beforehand. Unfortunately, errors in this calculation had led to two separate buffer overflow incidents in May 2026. With the new system in place, if incoming data exceeds the buffer size, the request will be terminated safely with an error, rather than causing memory corruption.
Subsequent updates have extended this protection to other areas of the code, including access logging. The latest version of freenginx, 1.31.3, was released on July 7, incorporating these critical changes. Shortly after, on July 15, nginx adopted these commits, assigning the vulnerability a CVE identifier, CVE-2026-42533, and issuing an official security advisory.
This vulnerability was particularly triggered when using the map directive with regular expressions and variable captures. However, the specific conditions required for exploitation may not be common in most deployed nginx instances, thus limiting the impact on users.
The vulnerability was first introduced in nginx version 0.9.6, with fixes rolling out in freenginx 1.31.3 and nginx versions 1.30.4 and 1.31.3. The security advisory from nginx also acknowledged numerous individuals for their independent reports and adherence to coordinated disclosure standards.
In conclusion, this update is a proactive step towards fortifying both freenginx and nginx against potential threats, which could improve user confidence and influence market competition as other providers may need to enhance their security measures in response.
Informational material. 18+.
