CVE-2026-42533: Check Point WAF Managed NGINX Deployments Are Not Vulnerable

[Vani]

F5 has disclosed CVE-2026-42533, a security vulnerability affecting specific NGINX configurations that use the map directive with regular expression matching under particular conditions. Successful exploitation could result in a denial-of-service (DoS) condition and, in certain environments, potentially lead to remote code execution.

We would like to reassure our customers that Check Point WAF managed NGINX deployments are not vulnerable to CVE-2026-42533.

Why Check Point WAF Customers Are Not Affected

Check Point WAF currently runs NGINX Open Source 1.30.4, which is listed by NGINX as not vulnerable to CVE-2026-42533.

Additionally, the vulnerability requires a specific configuration pattern involving the map directive, regex matching, and the order in which regex capture variables are referenced. None of Check Point WAF managed deployment templates use this vulnerable configuration, making the published attack vector not applicable to our managed service.

Customer Impact

No action is required for customers using Check Point WAF managed NGINX deployments.

As part of our secure software development lifecycle, we continuously monitor newly disclosed vulnerabilities, evaluate their applicability to our managed platform, and ensure our managed deployments remain protected through timely software updates and secure-by-default configurations.

Should additional guidance become necessary, we will communicate it through our standard customer notification channels.

[khatland]

New deployments might use 1.30.4, but I found we run 1.24.0-r16 which is on the affected list. 
But still our analysis found that the active NGINX-config did not find any  regex-capture-variables and no volatile-maps. 

Can you confirm that these versions are not vulnerable as well? Or do we need to redeploy?

[PhoneBoy]

Based on what @Vani said above, no, as we are not using a configuration that exposes the vulnerability.