nginx PCRE Capture Variable Heap Overflow to Pre-Auth RCE (CVE-2026-42533)

CVE-2026-42533 is a heap buffer overflow in nginx triggered by PCRE regex capture variable handling. When two map directives share the same capture group name, a length/value mismatch occurs in the internal variable copy code (ngx_http_script_copy_capture_code and ngx_http_script_copy_var_code). The first map sets the captured length, the second map overwrites the captured value with different content, but the copy code uses the stale (shorter) length for allocation while writing the full (longer) value, causing a heap overflow.

The exploit suite includes: crash PoC (heap corruption), info leak (libc and heap address disclosure from uninitialized heap residue), single-shot RCE chain (66% success rate), deterministic RCE variant, calibration tool for build-specific offsets, and a 13-site ASan test harness covering all affected code paths across HTTP and stream modules.

Root Cause

When nginx evaluates map directives with regex captures, the capture variable length is recorded during the first match but the value pointer may be overwritten by a subsequent map evaluation. The copy functions (ngx_http_script_copy_capture_code, ngx_http_script_copy_var_code) allocate based on the recorded length but memcpy based on the actual (potentially longer) value, overflowing the heap buffer.

Attack Flow

1. Info leak: Send crafted GET request with long URI matching a capture group; the response body contains uninitialized heap residue with libc and heap pointers
2. ASLR bypass: Extract libc base and heap pointer from leaked data, compute system() address
3. Heap spray: Open multiple connections to shape heap layout, create and free a hole at a predictable position
4. Overflow trigger: POST request with body matching the regex triggers the heap overflow, corrupting pool cleanup structures
5. RCE: Corrupted cleanup handler points to system() with attacker-controlled command argument; fires on connection close