Pre-auth nginx RCE explained with a capture-clobbering overflow

jedisct1 · x · 2026-07-20

A detailed exploit write-up on a pre-auth nginx RCE affecting 13 call sites, tracked as CVE-2026-42533.

• The diagram explains a shared mutable state bug: r->captures is clobbered between the regex LEN pass and VALUE pass.
• During the LEN pass, nginx sizes a buffer based on one set of captures; a later map-regex call overwrites those captures.
• The VALUE pass then uses the corrupted state, writing attacker-controlled content into a buffer that is too small.
• The result is a 197-byte overflow in the illustrated example.

The post credits Cyberstan and links to the original blog write-up.

Original post →

More from Safety

• Why So Many AI Researchers Think the Machines Could Kill Everyone — wiredmagazine · 2026-09-11
• California creates standards for independent AI auditors to verify lab safety testing — VraserX · 2026-09-11
• a16z podcast: why 2-3 person startups are absent from policy debates — a16z Podcast · 2026-09-11
• Researcher questions AI safety eval firm, citing 'blatantly sloppy' security and monitoring — Kyrannio · 2026-09-11
• Class action accuses Anthropic of overselling Claude subscriptions with deceptive usage multipliers — The Decoder · 2026-09-11
• MD shows buying lab media requires background checks, calling AI bioweapon doom scenarios implausible — Ghost_Pilot_MD · 2026-09-11

Safety channel →