FortiGuard Flags NGINX Heap Overflow in Appliances
FortiGuard Labs warned on CVE-2026-42533, a heap-based buffer overflow in NGINX Open Source and NGINX Plus that NGINX fixed on July 15, 2026. Fortinet said it reviewed products and services that use NGINX and, in its current assessment, its own products are not affected.
The bug sits in the map directive when regex matching and capture variables are combined in a specific pattern. A crafted HTTP request can crash the NGINX worker process and cause denial of service; in some setups, especially where address-space randomization is disabled or bypassed, the same corruption may be pushed toward code execution.
For operators, the important point is that exposure follows the embedded NGINX branch, not just the appliance brand. If NGINX is bundled inside a proxy, WAF, or gateway, the vulnerable component can be hidden behind a vendor label, so remediation scope depends on the shipped NGINX version and configuration, not the product family name.