CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

Vani — Wed, 29 Jul 2026 18:23:20 GMT

F5 has disclosed CVE-2026-42533, a security vulnerability affecting specific NGINX configurations that use the map directive with regular expression matching under particular conditions. Successful exploitation could result in a denial-of-service (DoS) condition and, in certain environments, potentially lead to remote code execution.

We would like to reassure our customers that Check Point WAF managed NGINX deployments are not vulnerable to CVE-2026-42533.

Why Check Point WAF Customers Are Not Affected

Check Point WAF currently runs NGINX Open Source 1.30.4, which is listed by NGINX as not vulnerable to CVE-2026-42533.

Additionally, the vulnerability requires a specific configuration pattern involving the map directive, regex matching, and the order in which regex capture variables are referenced. None of Check Point WAF managed deployment templates use this vulnerable configuration, making the published attack vector not applicable to our managed service.

Customer Impact

No action is required for customers using Check Point WAF managed NGINX deployments.

As part of our secure software development lifecycle, we continuously monitor newly disclosed vulnerabilities, evaluate their applicability to our managed platform, and ensure our managed deployments remain protected through timely software updates and secure-by-default configurations.

Should additional guidance become necessary, we will communicate it through our standard customer notification channels.

Re: CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

khatland — Thu, 30 Jul 2026 07:17:21 GMT

New deployments might use 1.30.4, but I found we run 1.24.0-r16 which is on the affected list.
But still our analysis found that the active NGINX-config did not find any regex-capture-variables and no volatile-maps.

Can you confirm that these versions are not vulnerable as well? Or do we need to redeploy?

Re: CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

PhoneBoy — Thu, 30 Jul 2026 13:28:48 GMT

Based on what @Vani said above, no, as we are not using a configuration that exposes the vulnerability.

topic Re: CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable in WAF

CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

Why Check Point WAF Customers Are Not Affected

Customer Impact

Re: CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

Re: CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable