StackRadar

CVE-2026-42533

Critical

Advisory

Published 15 Jul 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.2
base score, highest
EPSS
0.045
91st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,781 indexed, latest versions
Container images
119
deployed by those charts
Fix available
6 of 6
affected packages

NGINX Map directive and Regex matching vulnerability

Carried by container images the latest versions of 119 of 17,781 indexed charts deploy, on 119 images.

Affected packageAffected versionsFixed inImages
nginxdeb1.4.6-1ubuntu3.8ppa1, 1.18.0-0ubuntu1.2, 1.18.0-0ubuntu1.3, 1.18.0-0ubuntu1.4+35 more1.18.0-6ubuntu14.20, 1.24.0-2ubuntu7.17, 1.26.3-3+deb13u888
nginxapk1.26.2-r4, 1.26.3-r0, 1.28.0-r3, 1.28.1-r1+4 more1.26.3-r2, 1.28.3-r614
nginxbitnami1.25.5-0, 1.27.1-2, 1.28.0-0, 1.31.3-01.30.44
nginx-mainlineapk1.27.4-r0, 1.27.4-r2, 1.29.8-r11.31.3-r03
NGINX Open Sourcebitnami1.25.5-01.30.41
nginxrpm1:1.20.1-13.el9, 1:1.22.1-5.module+el9.3.0.z+20438+032561a0, 1:1.22.1-8.module+el9.5.0+22953+b175c265.1, 1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3+3 more1.21.5-150600.10.27.1, 2:1.20.1-28.el9_8.610
OSV records
ALPINE-CVE-2026-42533BIT-nginx-2026-42533CGA-3cc9-j23w-933vDEBIAN-CVE-2026-42533RHSA-2026:66542UBUNTU-CVE-2026-42533SUSE-SU-2026:3469-1
Also known as
BIT-nginx-gateway-2026-42533, CGA-x99p-pq5w-pxj6, USN-8563-1, USN-8563-2, USN-8563-3, USN-8563-4

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
synapse-adminschoenwald1.0.11 of 1See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r6

Open the chart page →

1,802
tabixsinextraVerified publisher0.2.21 of 1See more

tabix sinextra 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/tabix:22.05.17a6e3e996a4ae
nginx@1.28.0-r3
1.28.3-r6

Open the chart page →

1,249
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
gcr.io/kubecost1/frontend:prod-2.5.5991c1465c658
nginx-mainline@1.27.4-r2
1.31.3-r0

Open the chart page →

7,901
substra-frontendsubstraVerified publisher1.2.31 of 1See more

substra-frontend substra 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-frontend:1.0.0e230e6ac0722
nginx@1.25.4-1~bookworm
no fix listed

Open the chart page →

3,032
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
nginx@1.26.3-3+deb13u6
1.26.3-3+deb13u8

Open the chart page →

4,674
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka-ui:0.4.1b2dfabe13cfe
nginx-mainline@1.29.8-r1
1.31.3-r0

Open the chart page →

1,556
super-mariotechpreta0.1.11 of 1See more

super-mario techpreta 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
nirmalnaveen/supermario:latest8541a39162f3
nginx@1.25.3-1~bookworm
no fix listed

Open the chart page →

6,297
mrasiftech-thinker1.0.41 of 1See more

mrasif tech-thinker 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nginx@1.28.1-r1
1.28.3-r6

Open the chart page →

2,043
tensor_apptensor-app0.2.22 of 3See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
xeladock/mysql_dns:latest4baf531453f1
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.20
xeladock/nginx2:latestc259a67b1dff
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.20

Open the chart page →

17,461
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
library/nginx:1.27.1287ff321f9e3
nginx@1.27.1-1~bookworm
no fix listed

Open the chart page →

39,090
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
library/nginx:1.27.1287ff321f9e3
nginx@1.27.1-1~bookworm
no fix listed

Open the chart page →

28,814
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
library/nginx:1.27.1287ff321f9e3
nginx@1.27.1-1~bookworm
no fix listed

Open the chart page →

28,385
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
library/nginx:1.27.1287ff321f9e3
nginx@1.27.1-1~bookworm
no fix listed

Open the chart page →

28,858
orchestra-login-portaltremolo2.3.971 of 1See more

orchestra-login-portal tremolo 2.3.97

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s-react:1.0.2afb3e9282952
nginx@1.18.0-6ubuntu14.7
1.18.0-6ubuntu14.20

Open the chart page →

2,956
opencloudunxwaresVerified publisher0.2.36 of 13See more

opencloud unxwares 0.2.3

6 of the 13 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
nginx@1.27.4-1~bookworm
no fix listed
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
nginx@1.27.4-1~bookworm
no fix listed
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
nginx@1.27.4-1~bookworm
no fix listed
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
nginx@1.27.4-1~bookworm
no fix listed
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
nginx@1.27.4-1~bookworm
no fix listed
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
nginx@1.27.4-1~bookworm
no fix listed

Open the chart page →

45,239
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
nginx@1.22.1-9+deb12u2
no fix listed

Open the chart page →

5,984
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
nginx@1.20.1-1~focal
no fix listed

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
nginx@1.20.1-1~focal
no fix listed

Open the chart page →

28,605
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-42533.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
nginx@1.25.5-1~bookworm
no fix listed

Open the chart page →

7,673

Container images carrying it

119 by charts deploying them

A fixed version is listed for 6 of the 6 affected packages.

Container imageDigestPackageFixed inUsed by
library/nginx:1.27.1287ff321f9e3
nginx@1.27.1-1~bookworm
no fix listed
4
library/nginx:1.25:1.25.5a484819eb602
nginx@1.25.5-1~bookworm
no fix listed
3
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
nginx@1.25.1-1~bookworm
no fix listed
3
hookiesolutions/webhookie:latest0629694246ba
nginx@1.20.1-1~focal
no fix listed
2
library/nginx:1.27.098f8ec75657d
nginx@1.27.0-2~bookworm
no fix listed
2
moreillon/group-manager-front:v3.3.1c9f85db3baa5
nginx@1.27.0-2~bookworm
no fix listed
2
moreillon/user-manager-front:v5.0.3b067dbbbb6af
nginx@1.25.3-1~bookworm
no fix listed
2
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
nginx@1.27.4-1~bookworm
no fix listed
2
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
nginx@1.27.4-1~bookworm
no fix listed
2
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
nginx@1.27.4-1~bookworm
no fix listed
2
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
nginx@1.27.4-1~bookworm
no fix listed
2
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
nginx@1.27.4-1~bookworm
no fix listed
2
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
nginx@1.27.4-1~bookworm
no fix listed
2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss:unprivileged-oss-202503313db8145349a3
nginx@1.27.2-1~bookworm
no fix listed
2
allegroai/clearml:2.0.0-613713ae38f7daf
nginx@1.22.1-9
no fix listed
1
avzini/web-app:latestf40b30210ed0
nginx@1.25.3-1~bookworm
no fix listed
1
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r6
1
bitnamilegacy/nginx:1.27.1934d1acd5ca8
nginx@1.27.1-2
1.30.4
1
bitnamilegacy/nginx:1.28.0-debian-12-r0eaf9066e86f6
nginx@1.28.0-0
1.30.4
1
ckulka/baikal:0.10.1-nginx434bdd162247
nginx@1.29.0-1~bookworm
no fix listed
1
codetogether/codetogether:latest4348c8a38752
nginx@1:1.26.1-2.el9.ngx
2:1.20.1-28.el9_8.6
1
conductoross/conductor:3.31.09fba127693e6
nginx@1.26.3-3+deb13u6
1.26.3-3+deb13u8
1
countly/countly-server:25.05.4e3c238248f99
nginx@1.26.1-2~focal
no fix listed
1
dachichang/basic-auth-s3-nginx:1.0.07ccac90a935e
nginx@1.25.3-1~bookworm
no fix listed
1
dannielkil/book-frontend:latest937993927694
nginx@1.27.1-1~bookworm
no fix listed
1
datamate/seafile-professional:11.0.202dd66b722464
nginx@1.28.0-1~jammy
no fix listed
1
emqx/ecp-ui:2.5.1e33e9816f147
nginx@1.27.2-1~bookworm
no fix listed
1
extrim/perlite:1.5.99cb7eb5598b6
nginx@1.26.3-r0
1.26.3-r2
1
felipecs8/app-db-connection-test:v129e06c9c6385
nginx@1.27.2-1~bookworm
no fix listed
1
fnzv/dump1090:latestb3079b95c336
nginx@1.18.0-6ubuntu14.4
1.18.0-6ubuntu14.20
1
galaxy/galaxy-stable:v18.018e577a626dfd
nginx@1.4.6-1ubuntu3.8ppa1
no fix listed
1
hazegoodlife/haaze:veggiesite50f02d2d5d4d
nginx@1.27.4-1~bookworm
no fix listed
1
hazegoodlife/haaze:milksite8d4c63169e14
nginx@1.27.4-1~bookworm
no fix listed
1
heartexlabs/label-studio:latestaa461572e8f9
nginx@1.28.2-r1
1.28.3-r6
1
hecrom/myweatherangularclient:1.3.11bb0372939c19
nginx@1.27.0-2~bookworm
no fix listed
1
intel/multimodal-data-visualization-streaming:3.01a89327e499b
nginx@1.18.0-0ubuntu1.3
no fix listed
1
jeboehm/mailserver-web:5.0.929da13edf5aa8
nginx@1.28.0-r3
1.28.3-r6
1
kuzwolka/aws9:main1ad759b961b1
nginx@1.27.5-1~bookworm
no fix listed
1
kuzwolka/aws9:news3e8880fbbb96
nginx@1.27.5-1~bookworm
no fix listed
1
kuzwolka/aws9:blog4a7707410bf1
nginx@1.27.5-1~bookworm
no fix listed
1
kuzwolka/aws9:shop84a9d9766345
nginx@1.27.5-1~bookworm
no fix listed
1
lancachenet/monolithic:latest37f28b362c93
nginx@1.24.0-2ubuntu7.17
no fix listed
1
langflowai/langflow-frontend:latest54f67f1961fe
nginx@1.28.0-1~bookworm
no fix listed
1
library/nginx:1.27.409369da6b103
nginx@1.27.4-1~bookworm
no fix listed
1
library/nginx:1.276784fb0834aa
nginx@1.27.5-1~bookworm
no fix listed
1
library/nginx:1.25.167f9a4f10d14
nginx@1.25.1-1~bookworm
no fix listed
1
library/nginx:1.25.49ff236ed47fe
nginx@1.25.4-1~bookworm
no fix listed
1
library/nginx:1.28-alpinea8b39bd9cf0f
nginx@1.28.3-r1
1.28.3-r6
1
library/nginx:1.27.3fb197595ebe7
nginx@1.27.3-1~bookworm
no fix listed
1
linuxserver/bookstack:26.05.202605282ebf97852661
nginx@1.28.3-r2
1.28.3-r6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.