CVE-2026-42530— NGINX Open-Source ngx_http_v3_module vulnerability
In-the-Wild Activity Observed github_trending · low
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| F5 | NGINX Open Source | 1.31.0< 1.31.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42530
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NGINX Open-Source ngx_http_v3_module vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
释放后使用
Source: NVD (National Vulnerability Database)
Vulnerability Title
F5 NGINX Open Source 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
F5 nginx open source是美国F5公司开源的一款高性能Web服务器和反向代理。 F5 NGINX Open Source 1.31.0版本至1.31.2之前版本存在资源管理错误漏洞，该漏洞源于ngx_http_v3_module组件中的QPACK编码器流问题，可能导致远程未认证攻击者利用特制HTTP/3会话触发释放后重用，导致工作进程重启，或在ASLR禁用或绕过时执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| F5 | NGINX Open Source | 1.31.0 ~ 1.31.2 | - |
II. Public POCs for CVE-2026-42530
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42530
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42530 (1)
- NGINX ngx_http_v3_module vulnerability CVE-2026-42530vendor-advisory
Same Patch Batch · F5 · 2026-06-17 · 6 CVEs total
| CVE-2026-42055 | 8.1 HIGH | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability |
| CVE-2026-11311 | 8.1 HIGH | NGINX Gateway Fabric vulnerability |
| CVE-2026-50107 | 8.1 HIGH | NGINX Gateway Fabric vulnerability |
| CVE-2026-32682 | 6.5 MEDIUM | NGINX Gateway Fabric vulnerability |
| CVE-2026-48142 | 4.8 MEDIUM | NGINX ngx_http_charset_module vulnerability |
IV. Related Vulnerabilities
Same product: NGINX Open Source
- CVE-2026-42055
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vuln - CVE-2026-48142
NGINX ngx_http_charset_module vulnerability - CVE-2026-42926
NGINX ngx_http_proxy_v2_module vulnerability - CVE-2026-27654
NGINX ngx_http_dav_module vulnerability - CVE-2026-27651
NGINX ngx_mail_auth_http_module vulnerability
Same weakness: CWE-416
- CVE-2026-61861
ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCa - CVE-2026-34196
GPU DDK - UAF read and/or write of arbitrary physical memory - CVE-2026-56373
ImageMagick - Use-After-Free Write in PDB Decoder - CVE-2026-15194
Open5GS AMF context.c amf_context_final use after free - CVE-2026-15107
Google Chrome 资源管理错误漏洞
V. Comments for CVE-2026-42530
No comments yet