15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code ...

A 15-year-old pre-authentication remote code execution vulnerability in NGINX (CVE-2026-42533) allows attackers to crash workers and execute arbitrary code via a missing save/restore of regex capture state in the script engine. The flaw affects at least 13 call sites across multiple modules and is exploitable with high reliability using heap overflow and information leak primitives.

This Wire brief sits within Fusion42's coverage of Cybersecurity and Cloud Infrastructure. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.