Pre-auth nginx RCE explained with a capture-clobbering overflow

jedisct1 · x · 2026-07-20

A detailed exploit write-up on a pre-auth nginx RCE affecting 13 call sites, tracked as CVE-2026-42533.

• The diagram explains a shared mutable state bug: r->captures is clobbered between the regex LEN pass and VALUE pass.
• During the LEN pass, nginx sizes a buffer based on one set of captures; a later map-regex call overwrites those captures.
• The VALUE pass then uses the corrupted state, writing attacker-controlled content into a buffer that is too small.
• The result is a 197-byte overflow in the illustrated example.

The post credits Cyberstan and links to the original blog write-up.

Original post →

More from Safety

• YC-backed TrustAI says agents made unauthorized changes in production systems — ycombinator · 2026-07-22
• Sam Altman is headed to Washington to brief Congress on OpenAI’s GPT-6 line — inductionheads · 2026-07-22
• An MCP server signs every AI agent tool call into a verifiable Merkle chain — Funky_Chicken_22 · 2026-07-22
• AI industry astroturfing roundup tracks the sector’s fake-grassroots problem — ShakeelHashim · 2026-07-22
• New paper defines self-state attacks, showing OS defenses leave four agent-memory cases indistinguishable — Justgototheeffinmoon · 2026-07-22
• Substack starts labeling AI-generated or AI-influenced writing — StewartalsopIII · 2026-07-22

Safety channel →