CVE-2026-42533: is your nginx affected?

CVE-2026-42533 is part of this nginx update. The fixed version is listed on this page.

Last checked 23 Oct 2026 07:05 UTC Published 15 Jul 2026 14:33 UTC Assigned by f5

SeverityHigh7.0CVSS v3.1Red Hat

Affected upstream versions

Affected upstream version ranges by release line
Branch	Affected
All release lines	0.9.6-1.31.2
1.31	1.31.2 < 1.31.3
1.30	0.9.6 < 1.30.4

Fixed upstream

Upstream fixed releases by release line
Branch	Fixed in	Released	State
1.31	1.31.3	15 Jul 2026	UnconfirmedOne official source so far
1.30	1.30.4	–	UnconfirmedOne official source so far

Linux packages and images

All fixed versions

Rows with a fixed, not affected, waiting or fix pending state. Unconfirmed rows, end-of-life releases and third-party repositories are in the full table of nginx update.

Alpine Linux

Alpine Linux
Release	Package	Fixed version	State	Verified	Source
Alpine 3.24	nginx	1.30.4-r0	Fixed	26 Oct 2026 05:22 UTC	Source
edge(development)	nginx	1.30.4-r0	Fixed	26 Oct 2026 05:22 UTC	Source

Red Hat Enterprise Linux

Red Hat Enterprise Linux
Release	Package	Fixed version	State	Verified	Source
Red Hat Enterprise Linux 10	nginx	2:1.26.3-6.el10_2.7	Fixed	26 Oct 2026 05:09 UTC	RHSA-2026:67314
Red Hat Enterprise Linux 8	nginx:1.24/nginx	1:1.24.0-3.module+el8.10.0+24848+0300f002.5	Fixed	26 Oct 2026 05:09 UTC	RHSA-2026:67315
Red Hat Enterprise Linux 9	nginx:1.24/nginx	1:1.24.0-7.module+el9.8.0+24846+e7eec568.5	Fixed	26 Oct 2026 05:09 UTC	RHSA-2026:67308
Red Hat Enterprise Linux 9	nginx:1.26/nginx	2:1.26.3-9.module+el9.8.0+24845+a897661e.4	Fixed	26 Oct 2026 05:09 UTC	RHSA-2026:67283
Red Hat Enterprise Linux 9	nginx	2:1.20.1-28.el9_8.6	Fixed	26 Oct 2026 05:09 UTC	RHSA-2026:66542

Debian

Debian
Release	Package	Fixed version	State	Verified	Source
12(bookworm) security (LTS team)	nginx	1.22.1-9+deb12u10	Fixed	26 Oct 2026 05:19 UTC	Source
forky(testing)	nginx	1.30.4-3	Fixed	26 Oct 2026 05:19 UTC	Source
sid(unstable)	nginx	1.30.4-3	Fixed	26 Oct 2026 05:19 UTC	Source
13(trixie) security	nginx	1.26.3-3+deb13u8	Fixed	26 Oct 2026 05:19 UTC	Source

Ubuntu

Ubuntu
Release	Package	Fixed version	State	Verified	Source
24.04 LTS(noble)	nginx	1.24.0-2ubuntu7.18	Fixed	26 Oct 2026 05:09 UTC	USN-8563-5
26.04 LTS(resolute)	nginx	1.28.3-2ubuntu1.11	Fixed	26 Oct 2026 05:09 UTC	USN-8563-5
22.04 LTS(jammy)	nginx	1.18.0-6ubuntu14.21	Fixed	26 Oct 2026 05:09 UTC	USN-8563-5

CISA Known Exploited Vulnerabilities (KEV)

Not in the KEV catalog as of catalog version 2026.10.23, checked 26 Oct 2026. KEV catalog

How to check your system

Find the version you run: the upstream release for a source or vendor build, or the package version for a distribution package.
Compare it with the row for your own release line or distribution above. A distribution package is judged by its own version string, never by the upstream number.
Or paste the output into the version checker. It runs in your browser and sends nothing.
Check your version

Hosting providers, platform guides and the change log are on the page for nginx update.

Sources

CVE record · CVE Program
Upstream release or advisory · nginx.org · Last checked 23 Oct 2026 07:05 UTC
Buffer overflow when using map and regex Severity: major Advisory CVE-2026-42533 Not vulnerable: 1.31.3+, 1.30.4+ Vulnerable: 0.9.6-1.31.2
KEV catalog · CISA · Last checked 26 Oct 2026 07:26 UTC