Skip to content
Verified reproduction

CVE-2026-42533: NGINX ASLR-enabled network RCE

CVE-2026-42533 is verified against nginx/nginx · github affected versions: NGINX security index lists Open Source 0.9.6-1.31.2 as vulnerable and 1.31.3+ or 1.30.4+ as not vulnerable. F5 also lists NGINX Plus 37.0.0.1-37.0.2.1 fixed in 37.0.3.1 and R33-R36 fixed in R36 P7. vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00308.

REPRO-2026-00308 nginx/nginx · github RCE Jul 27, 2026 CVE entry .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 71m 44s
Tool calls 368
Spend $28.17
Affected NGINX security index lists Open Source 0.9.6-1.31.2 as vulnerable and 1.31.3+ or 1.30.4+ as not vulnerable. F5 also lists NGINX Plus 37.0.0.1-37.0.2.1 fixed in 37.0.3.1 and R33-R36 fixed in R36 P7.
$ pruva-verify REPRO-2026-00308
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00308/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Demonstrate genuine remote command execution for CVE-2026-42533 against NGINX commit 28219209e0b4f9e155fd8bd91ab81b8ac30628f2 while ASLR remains enabled. The attacker must be a separate network peer and may only use the target's real HTTP/TCP listeners. The proof must create a target-local command marker that is subsequently observable through the application boundary.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/logs/fixed-1.randomization-base0.0 KB
bundle/repro/reproduction_steps.sh33.8 KB
bundle/logs/fixed-2.leak-backend.log0.0 KB
bundle/logs/fixed-2.exploit-backend.log1.2 KB
bundle/repro/validation_verdict.json1.0 KB
bundle/repro/rca_report.md7.4 KB
bundle/repro/runtime_manifest.json3.2 KB
bundle/logs/reproduction_steps.log2.2 KB
bundle/logs/fixed-1.attacker.log6.3 KB
bundle/logs/fixed-2.attacker.log6.3 KB
bundle/logs/fixed-2.mitigations99.5 KB
bundle/logs/aslr_verifier.log0.1 KB
bundle/logs/patch_hunk_verification.log0.1 KB
bundle/logs/fixed_commit_stat.log0.3 KB
bundle/logs/fixed_commit_detail.log2.1 KB
bundle/logs/nginx_conf_sha256.log0.1 KB
bundle/logs/vulnerable-docker-build.log1.7 KB
bundle/logs/fixed-docker-build.log1.6 KB
bundle/logs/vulnerable-1.healthcheck.log0.2 KB
bundle/logs/vulnerable-1.target.inspect.json8.9 KB
bundle/logs/vulnerable-1.worker-pid0.0 KB
bundle/logs/vulnerable-1.build-id0.0 KB
bundle/logs/vulnerable-1.binary-sha2560.1 KB
bundle/logs/vulnerable-1.randomization-base0.0 KB
bundle/logs/vulnerable-1.attacker.inspect.json8.2 KB
bundle/logs/vulnerable-1.proof-http-response0.3 KB
bundle/logs/vulnerable-1.container.log0.1 KB
bundle/logs/vulnerable-1.nginx-error.log0.7 KB
bundle/logs/vulnerable-1.leak-backend.log0.0 KB
bundle/logs/vulnerable-1.exploit-backend.log1.9 KB
bundle/logs/vulnerable-2.healthcheck.log0.2 KB
bundle/logs/vulnerable-2.target.inspect.json8.9 KB
bundle/logs/vulnerable-2.worker-pid0.0 KB
bundle/logs/vulnerable-2.build-id0.0 KB
bundle/logs/vulnerable-2.binary-sha2560.1 KB
bundle/logs/vulnerable-2.randomization-base0.0 KB
bundle/logs/vulnerable-2.attacker.inspect.json8.2 KB
bundle/logs/vulnerable-2.proof-http-response0.3 KB
bundle/logs/vulnerable-2.container.log0.1 KB
bundle/logs/vulnerable-2.nginx-error.log0.7 KB
bundle/logs/vulnerable-2.leak-backend.log0.0 KB
bundle/logs/vulnerable-2.exploit-backend.log1.9 KB
bundle/logs/fixed-1.healthcheck.log0.2 KB
bundle/logs/fixed-1.target.inspect.json8.9 KB
bundle/logs/fixed-1.worker-pid0.0 KB
bundle/logs/fixed-1.maps5.7 KB
bundle/logs/fixed-1.build-id0.0 KB
bundle/logs/fixed-1.binary-sha2560.1 KB
bundle/logs/fixed-1.attacker.inspect.json8.1 KB
bundle/logs/fixed-1.marker0.1 KB
bundle/logs/fixed-1.proof-http-response0.3 KB
bundle/logs/fixed-1.container.log0.1 KB
bundle/logs/fixed-1.nginx-error.log7.1 KB
bundle/logs/fixed-1.leak-backend.log0.0 KB
bundle/logs/fixed-1.exploit-backend.log1.2 KB
bundle/logs/fixed-2.healthcheck.log0.2 KB
bundle/logs/fixed-2.target.inspect.json8.9 KB
bundle/logs/fixed-2.worker-pid0.0 KB
bundle/logs/fixed-2.maps5.7 KB
bundle/logs/fixed-2.build-id0.0 KB
bundle/logs/fixed-2.binary-sha2560.1 KB
bundle/logs/fixed-2.randomization-base0.0 KB
bundle/logs/fixed-2.attacker.inspect.json8.1 KB
bundle/logs/fixed-2.marker0.1 KB
bundle/logs/fixed-2.proof-http-response0.3 KB
bundle/logs/fixed-2.container.log0.1 KB
bundle/logs/fixed-2.nginx-error.log7.1 KB