[meta-webserver][scarthgap][PATCH] nginx: backport fix for CVE-2026-42533

This fix was made available with v1.30.4 [1] version of nginx:

https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336

and the CVE is further described here: https://nvd.nist.gov/vuln/detail/CVE-2026-42533

[1]: https://github.com/nginx/nginx/releases/tag/release-1.30.4

Signed-off-by: João Marcos Costa (Schneider Electric) <[email protected]>
---
 .../nginx/files/CVE-2026-42533.patch          | 52 +++++++++++++++++++
 meta-webserver/recipes-httpd/nginx/nginx.inc  |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533.patch

diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533.patch
new file mode 100644
index 0000000000..c0beb91e3d
--- /dev/null
+++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-42533.patch
@@ -0,0 +1,52 @@
+From 49c1c89136d3b1a0f6c1c2d645a7ceaf78efbf70 Mon Sep 17 00:00:00 2001
+From: Pavel Pautov <[email protected]>
+Date: Fri, 15 May 2026 00:48:50 -0700
+Subject: [PATCH] Fixed uninitialized memory read caused by stale regex
+ captures.
+
+When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
+r->ncaptures value, if regex didn't match. So the next use of unnamed regex
+capture triggers uninitialized read and potential buffer overrun.
+
+This config demonstrates the issue:
+    map test $my_map {
+        volatile;
+
+        ~mismatch(.*) 1; # reallocates r->captures in subrequests
+
+        default "";
+    }
+
+    server {
+        location ~(.*) { # sets r->ncaptures
+            slice 50;
+
+            # $1 will read from uninitialized memory in slice subrequests
+            proxy_set_header Test $my_map$1;
+
+            proxy_set_header Range $slice_range;
+            proxy_pass http://backend;
+        }
+    }
+
+The issue was introduced by 746fba0d79c6.
+
+CVE: CVE-2026-42533
+Upstream-Status: Backport [https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336]
+Signed-off-by: João Marcos Costa (Schneider Electric) <[email protected]>
+---
+ src/http/ngx_http_variables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
+index 16ffda3fe..47d78482b 100644
+--- a/src/http/ngx_http_variables.c
++++ b/src/http/ngx_http_variables.c
+@@ -2624,6 +2624,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
+ 
+         if (r->captures == NULL || r->realloc_captures) {
+             r->realloc_captures = 0;
++            r->ncaptures = 0;
+ 
+             r->captures = ngx_palloc(r->pool, len * sizeof(int));
+             if (r->captures == NULL) {
diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc
index e392ed107c..ad0712c96b 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx.inc
+++ b/meta-webserver/recipes-httpd/nginx/nginx.inc
@@ -29,6 +29,7 @@ SRC_URI = " \
     file://CVE-2025-23419.patch \
     file://CVE-2026-1642.patch \
     file://CVE-2026-27784.patch \
+    file://CVE-2026-42533.patch \
 "
 
 inherit siteinfo update-rc.d useradd systemd
-- 
2.47.0