Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS nginx may expose data or crash via regex
published 3 months ago
Summary
The nginx web server packages for CentOS (including all-modules, filesystem, image filter, and perl modules) can be tricked into revealing memory contents or stopping unexpectedly when specially crafted regular‑expression patterns are used. This happens because the software could write past the end of a buffer during processing. Update to the latest nginx release from the CentOS repositories to apply the fix.
What to do
- Update centos nginx to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-all-modules to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-filesystem to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-mod-http-image-filter to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-mod-http-perl to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-mod-http-xslt-filter to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-mod-mail to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
- Update centos nginx-mod-stream to version 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.4 | centos | nginx |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-all-modules |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-filesystem |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-mod-http-image-filter |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-mod-http-perl |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-mod-http-xslt-filter |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-mod-mail |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
| TuxCare:CentOS:8.4 | centos | nginx-mod-stream |
< 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12 Fix: upgrade to 1:1.14.1-9.module_el8.4.0+2449+d976c26a.tuxcare.els12
|
Original advisory text
nginx: Fix of CVE-2026-42533
- CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables
References
- https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1784800112.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42533 Vendor Advisory
Timeline
Published23 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784800112 · OSV
Track software like this
Free during beta