CVE-2026-42530
HighCVSS 8.1Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
NGINX Open Source has a vulnerability in the ngx_http_v3_module. When configured with the HTTP/3 QUIC module, a remote unauthenticated attacker, under specific conditions, can use a crafted HTTP/3 session to reopen a QPACK encoder stream, causing a Use-after-Free in the NGINX worker process leading to a restart. On systems with ASLR disabled or bypassed, code execution is possible.
Risk Assessment
The risk includes service disruption (worker process restart) and potential remote code execution if ASLR is disabled or bypassed, which could lead to full server compromise.
Recommendation
Immediately update NGINX Open Source to a patched version addressing CVE-2026-42530. If not possible, consider temporarily disabling the HTTP/3 QUIC module.
Other vulnerabilities in NGINX Open Source
See all- CVE-2026-42926Medium
A vulnerability in NGINX Open Source allows an attacker to inject frame headers and payload bytes to the upstream peer when configured to proxy HTTP/2 and using proxy_set_body.
- CVE-2026-27784High
A vulnerability in the 32-bit NGINX Open Source ngx_http_mp4_module module allows an attacker to over-read or over-write worker memory using a crafted MP4 file, potentially causing worker termination. Only 32-bit builds with the module enabled and the mp4 directive in use are affected.
Original NVD description (English source)
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.