Do Son 
TL;DR: A public proof-of-concept now targets CVE-2026-42530, an NGINX HTTP/3 RCE flaw rated CVSS 9.2. The use-after-free sits in the QPACK code of the HTTP/3 module. F5 fixed it in NGINX Open Source 1.31.2.
- CVE: CVE-2026-42530
- CVSS: 9.2 (Critical · CVSSv4)
- Product: F5 NGINX Open Source
- Affected: 1.31.0
- Impact: NGINX Open-Source ngx_http_v3_module vulnerability
- Status: No confirmed exploitation yet
- Patched in: 1.31.2
- EPSS: 3.7% (30-day)
- Action: Update to 1.31.2 now
Why This NGINX HTTP/3 RCE Matters
A remote, unauthenticated attacker can reach the bug. It needs no login and no user interaction. However, the server must run the HTTP/3 QUIC module, which stays off by default.
The reliable impact is a worker-process crash and denial of service. Code execution works only where ASLR is off, or where an attacker bypasses it. Still, the flaw sits at the network edge, so exposure can spread fast.
How the Attack Works
HTTP/3 uses QPACK to compress headers. NGINX handles QPACK data through unidirectional encoder streams. The buggy code allocates a session-wide buffer from a single stream’s pool rather than the connection pool.
When that stream closes, its pool frees. The session then keeps a dangling pointer to the freed buffer. A later stream reuses that memory, which triggers the use-after-free inside the worker.
CyStack researcher Trung Nguyen described the root cause as a lifetime mismatch. depthfirst later published a full write-up alongside a working proof-of-concept.
Public Disclosure and Exploit Status
Both the vulnerability details and the exploit code are now open. The public technical report ships a script that crashes an ASAN build. For the vendor view, see F5’s security advisory. So far, researchers have confirmed no in-the-wild exploitation as of late July 2026.
Affected Versions
NGINX Open Source 1.31.0 and 1.31.1 are vulnerable. The fix landed in 1.31.2 on June 17, 2026. Because the bug ships in the bundled NGINX component, several F5 products inherit it:
- NGINX Instance Manager 2.17.0 through 2.22.0 — fixed in 2.22.1
- NGINX Gateway Fabric 2.0.0 through 2.6.3 — fixed in 2.6.4
- NGINX Ingress Controller 5.0.0 through 5.5.0 — fixed in 5.5.1
Patch and Mitigation Steps
Upgrade to NGINX Open Source 1.31.2 or a fixed product release right away. If you cannot patch, disable HTTP/3 by removing the “http3 on;” directive and the quic listen parameter. That change drops the attack surface entirely.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
