AlmaLinux issues testing packages for nginx regression affecting volatile map variables

AlmaLinux has released patched nginx packages to the testing repository to resolve a regression introduced by a previous security update for CVE-2026-42533. The original security fix addressed a buffer overrun in the nginx script engine but inadvertently caused intermittent HTTP 500 errors and '[alert] no buffer space in script copy' logs in specific configurations.

The issue specifically affects users employing 'set' or 'rewrite' directives with variables from 'volatile' maps that contain other variables. This triggers nested script execution, which corrupted the global buffer state used to maintain ABI compatibility. AlmaLinux is calling for community testing across its 8, 9, and 10 releases before moving these fixes to production repositories.

Technical cause and the AlmaLinux fix

• Root Cause: To avoid breaking the Application Binary Interface (ABI) for third-party modules, the backported CVE-2026-42533 fix used a single global variable to track the script engine's buffer end instead of the per-instance field used in upstream nginx.
• Regression Mechanism: When a 'volatile' map triggers a nested script, the inner script overwrites this global buffer end value. Upon returning to the outer script, the bounds check compares against the incorrect, nested buffer limit, leading to random failures.
• Implementation of Fix: The new patch modifies functions including ngx_http_complex_value() and ngx_http_script_run() to save the current global buffer end before execution and restore it immediately upon completion.
• ABI Preservation: By managing the global state via save/restore logic rather than changing the script engine structure, the fix maintains compatibility with existing dynamic modules.

Why it matters

This development is critical for enterprise Linux users on RHEL-based distributions who rely on nginx for complex routing or caching logic. The fix ensures that security patches for memory corruption vulnerabilities do not compromise service availability, and the reported fix (RHEL-300689) will eventually benefit the broader CentOS Stream and RHEL ecosystems.