TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researchers say it even carries its own ASLR bypass, which raises the odds of remote code execution. F5 patched it on July 15, 2026. Why This NGINX Heap Overflow Matters The flaw needs no login and no user interaction.