High severity · published Jun 17, 2026
CVE-2026-42530
NGINX Open-Source ngx_http_v3_module vulnerability
8.1
CVSS
6.5%
EPSS
No
On KEV
Description
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
NGINX Open Source · F5
1.31.0 before 1.31.2 · source: vendor, NVD
NG
Nginx Gateway Fabric · F5
1.3.0 through 1.6.2; 2.0.0 before 2.6.4 · source: NVD
NI
Nginx Ingress Controller · F5
3.5.0 through 3.7.2; 5.0.0 before 5.5.1; 4.0.0; 4.0.1 · source: NVD
NI
Nginx Instance Manager · F5
2.17.0 through 2.22.0 · source: NVD
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: CISA
In the news
VulnerabilityCritical
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution
F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems.
The vulnerabilities are listed below -
CVE-2026-42530 (CVSS v4 score: 9.2) - A use-after-free vulnerability in the ngx_http_v3_module that could be triggered by a remote unauthenticated attacker when NGINX Open Source is
Jun 18, 2026·The Hacker News
VulnerabilityCritical
F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution
F5 released emergency updates for critical NGINX flaws (CVE-2026-42530, CVE-2026-42055) that could enable unauthenticated code execution. F5 has issued out-of-band patches for multiple NGINX vulnerabilities, including two critical flaws, respectively tracked as CVE-2026-42530 and CVE-2026-42055 (CVSS 9.2). The bugs affect HTTP modules and can be exploited remotely without authentication to trigger memory corruption, potentially causing […]
Jun 18, 2026·Security Affairs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42530
Vendor Advisory
https://my.f5.com/manage/s/article/K000161616
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20351
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-42530
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2489872
Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json
More from NGINX Open Source
8.2
CVE-2026-60005
NGINX ngx_http_slice_module vulnerability
8.2
CVE-2026-27654
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this…
8.1
CVE-2026-97205
NGINX ngx_http_core_module vulnerability
8.1
CVE-2026-93479
NGINX map directive and regex matching vulnerability
8.1
CVE-2026-15176
NGINX ngx_http_core_module vulnerability