Nginx and Apache vulnerabilities in 2026: CVE-2026-42533, CVE-2026-23918 and the versions to run

If you run nginx, upgrade to 1.30.6 or later on the stable branch, or 1.31.7 or later on mainline. Those releases close CVE-2026-42533, the critical map-directive heap overflow disclosed in July 2026, and the medium-severity nginx advisories fixed since. If you run Apache HTTP Server 2.4.66, upgrade to 2.4.67 to fix CVE-2026-23918, a double-free in HTTP/2 handling that can crash the server and, on common Debian-based setups, potentially execute code.

Web servers are the most exposed software most businesses run: they face the internet by design and parse every request before the application sees it. This article covers what changed in 2026, how to tell whether your configuration is actually affected, and how to fix it without breaking production.

CVE-2026-42533: the 15-year-old nginx heap overflow

Analyses from bex.co note that more than a dozen researchers reported the issue to F5 independently, which says something about how many people were looking at nginx internals in 2026. The bug is old, but it is also narrow: it needs a particular configuration pattern.

The root cause

The map directive sets a variable based on another value, and it can match using regular expressions with capture groups such as $1 and $2. The overflow happens when a string expression uses a numbered capture like $1 and then, later in the same expression, evaluates a regex map variable. nginx sizes the output buffer for one value of $1, then the map evaluation runs a new regex match that changes $1, and nginx writes the new, longer value into the buffer sized for the old one. Because the matched value can come from a request header or URL, the attacker controls how much is written.

The usual result is a crashed worker process, which nginx restarts, so the visible effect is denial of service. Code execution becomes possible where address space layout randomisation (ASLR) is disabled or can be bypassed. No authentication is needed either way.

Is your configuration affected?

Search for regex maps first, then for numbered captures used in the same expressions as map variables. The analyses suggest these patterns as a starting point.

# Version
nginx -v

# Regex map blocks
grep -rnE 'map\s+.*\{' /etc/nginx | head
grep -rnE '^\s*~' /etc/nginx | head

# Numbered captures used in expressions
grep -rnE '\$[0-9]' /etc/nginx

If you find a regex map whose numbered captures are interpolated into another expression ahead of the mapped variable, treat the server as affected until it is upgraded. The documented stopgap is to use named captures, such as (?<path>...), and to reference them only inside the block that holds the match. That is a configuration workaround, not a substitute for the upgrade.

Which products ship the vulnerable code

Because the bug is in nginx core, it reaches every product built on it. F5 listed NGINX Plus, NGINX Gateway Fabric (fixed in 2.6.7), the NGINX Ingress Controller (fixed in 5.5.3 or 2026-lts-r4), F5 WAF for NGINX, NGINX App Protect WAF and NGINX Instance Manager. HeroDevs also highlighted that the community ingress-nginx controller for Kubernetes is end of life, so clusters still running it depend on whatever nginx build it shipped with. If nginx sits inside a Kubernetes ingress, the ingress controller version is what you upgrade.

The nginx fixes that followed

CVE-2026-42533 was the headline, but it was not the only nginx advisory this year. The official advisory list shows several more, most rated medium, fixed in 1.31.7 and 1.30.6 or earlier. Staying on 1.30.4 because it fixed the critical one leaves these open.

Several of these depend on features many servers do not use, such as HTTP/3, AIO or TLS session tickets, and that is worth knowing when you assess exposure. It is not a reason to skip the upgrade: patch releases within a branch are low-risk, and configuration tends to change long after the last security review.

CVE-2026-23918: Apache HTTP/2 double-free

The root cause

The bug is a double-free in the HTTP/2 stream clean-up path of mod_http2. A client sends an HTTP/2 HEADERS frame and immediately follows it with RST_STREAM carrying a non-zero error code on the same stream, before the multiplexer has registered the stream. Two clean-up paths then free the same memory. Freeing memory twice corrupts the allocator's state, which crashes the process and can, in the right conditions, give an attacker control.

The denial-of-service path is described as trivial on any default deployment with mod_http2 and a multi-threaded MPM. The code execution path needs the Apache Portable Runtime built with the mmap allocator, which is the default on Debian-derived systems and in the official httpd Docker image. That combination is common, which is why this flaw drew headlines warning that millions of servers could be at risk.

How to check and fix

# Version (Debian/Ubuntu use apache2, RHEL uses httpd)
apache2 -v 2>/dev/null || httpd -v

# Is HTTP/2 enabled?
apache2ctl -M 2>/dev/null | grep -i http2
grep -rn "Protocols" /etc/apache2 /etc/httpd 2>/dev/null

Upgrade to 2.4.67, or to your distribution's patched package. Distribution packages often keep the old version number with a security suffix, so check the vendor's advisory rather than comparing numbers with apache.org. If you cannot upgrade immediately, disabling HTTP/2 by setting Protocols http/1.1 removes the vulnerable code path at the cost of HTTP/2 performance benefits. Revert that change after patching.

Apache users should also look at PHP2Shell, disclosed in October 2026. The PHP project considers Apache with mod_php the highest-risk deployment for those PHP vulnerabilities, so an Apache server is often a PHP server too.

Find every web server before you patch

Web servers hide in more places than the obvious host. A patch plan that covers only the server everyone remembers leaves the others exposed, and they are often the ones nobody has updated in years.

Distribution versions are not upstream versions

Debian, Ubuntu and Red Hat often backport security fixes into an older version number. A distribution nginx package can report an older upstream version number and still contain the fix for CVE-2026-42533, while an unmaintained build can report a newer number and lack it. For distribution packages, check the vendor's security tracker for the CVE rather than comparing version numbers with nginx.org or apache.org.

Patching web servers without an outage

1. 1

   Find every instance

   Include reverse proxies, load balancers, ingress controllers and the web servers inside application containers, not just the ones on the main host.

2. 2

   Test the configuration first

   Run nginx -t or apachectl configtest against the new version, ideally in a throwaway container using the production configuration files.

3. 3

   Reload, do not restart, where possible

   nginx and Apache can reload configuration gracefully, but a binary upgrade usually needs a restart or a container replacement. Schedule that, and keep the old image tagged for rollback.

4. 4

   Mind the DNS cache

   Reverse proxies in Docker cache container addresses. If an upstream container is recreated with a new IP, configure a short resolver validity or reload the proxy, or users get 502 and 504 errors.

5. 5

   Verify from outside

   Check each site's status codes, TLS and response headers after the change, and watch error rates for an hour.

What 2026 says about web server security

Two observations stand out. First, mature does not mean finished: nginx's map overflow survived fifteen years of releases, and the flood of independent reports shows how much more scrutiny core infrastructure now gets. Second, most of these flaws depend on configuration: a regex map, HTTP/2, a particular memory allocator. Knowing your own configuration turns a frightening headline into a quick, accurate yes or no.

Pin web server images to exact versions, rebuild them on a schedule, and keep a short list of where each server runs. That is what makes the next advisory an afternoon's work instead of a week of discovery.