Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade. Triggering it can crash or restart the worker, causing a denial of

The article reports a critical heap buffer overflow vulnerability in NGINX (CVE-2026-42533) that allows a remote, unauthenticated attacker to crash or restart worker processes and, under certain conditions such as disabled or bypassed ASLR, achieve remote code execution in affected versions of NGINX Open Source and NGINX Plus.[1][2][3] Fixed builds include nginx 1.30.4 and 1.31.3, and NGINX Plus 37.0.3.1 and R36 P7, with earlier versions requiring urgent upgrades to avoid denial-of-service and possible code execution.[1][3][4][5] From a RealGround perspective, this is an AI supply chain risk because compromised NGINX data-plane components can be used as an entry point to attack AI agents or APIs that sit behind NGINX, alter traffic to AI services, or exfiltrate data flowing through model endpoints. Organizations should ensure all NGINX instances in front of AI services are inventoried via SBOM, patched to non-vulnerable versions, and continuously monitored, integrating these components into their broader AI supply chain and deployment hardening strategy.