NGINX Open Source has a vulnerability in the ngx_http_v3_module module.

CVE-2026-42530 is a use-after-free in NGINX Open Source's ngx_http_v3_module, specifically in the QPACK encoder stream lifecycle. When a QUIC session reopens an encoder stream, a stale pointer to stream-scoped memory persists at the connection level, allowing an unauthenticated remote attacker to crash the NGINX worker process via crafted HTTP/3 traffic over UDP/443. On systems where ASLR is disabled or bypassed, this could theoretically escalate to arbitrary code execution under the NGINX worker user (typically www-data or nginx). Only versions 1.31.0 and 1.31.1 are affected — two mainline releases, patched in 1.31.2 on June 17, 2026.

F5's vendor score of 8.1 (CVSS v3.1) and 9.2 (CVSS v4.0) overstates practical risk for most enterprises. The v3.1 vector already includes AC:H, acknowledging exploitation difficulty. The real-world narrowing goes further: the affected version window is just two mainline releases that most production fleets never adopted, HTTP/3 must be *explicitly* enabled via listen ... quic, and RCE requires ASLR to be absent — a condition that essentially doesn't exist on modern Linux. The reliable impact is DoS via worker restart, which NGINX auto-recovers from. The vendor score treats theoretical RCE as the primary impact; defenders should weight the DoS-only reality more heavily.

Why this verdict

• Narrow version window: Only NGINX 1.31.0 and 1.31.1 are affected — two mainline releases. Most enterprise deployments run stable branches or older mainline. This dramatically reduces the reachable population compared to a vulnerability affecting all NGINX versions.
• HTTP/3 must be explicitly enabled: The listen ... quic directive is not present in default configurations. Many NGINX deployments serve HTTP/1.1 and HTTP/2 only, making them completely immune regardless of version.
• RCE requires ASLR bypass: The realistic impact for virtually all deployments is DoS via worker restart, not code execution. ASLR is enabled by default on all modern Linux distributions. The vendor's HIGH/CRITICAL score weights a theoretical RCE that has no practical path on hardened systems.
• Role multiplier: NGINX at the network edge (reverse proxy, load balancer, TLS terminator) is a high-value component. If RCE were reliable, a compromised edge NGINX would expose TLS private keys, upstream credentials, and provide a network pivot into backend infrastructure. This role prevents downgrading below HIGH despite the narrow version range. However, the DoS-only realistic outcome (worker auto-restarts) limits blast radius to transient availability degradation rather than fleet compromise.
• No exploitation pressure: No KEV listing, no active campaigns, no weaponized PoC. EPSS at 3.7% reflects moderate but not urgent threat. The safe checker tool lowers the bar for identification but not for exploitation.

Why not higher?

CRITICAL would require either active exploitation or a realistic RCE path. The AC:H in the vendor's own CVSS vector acknowledges exploitation difficulty, and the ASLR requirement for RCE makes code execution effectively theoretical on modern Linux. The affected version range (two mainline releases) means the vast majority of NGINX deployments are not vulnerable at all. A CRITICAL rating would overstate urgency for a DoS-primary vulnerability with this narrow an exposure window.

Why not lower?

NGINX is a canonical network-edge component — reverse proxies and load balancers sit at the trust boundary between the internet and internal infrastructure. The vulnerability is unauthenticated and network-reachable over UDP, bypassing TCP-focused security controls. Even as a DoS-only bug, repeated worker crashes at the edge can degrade availability for all services behind that NGINX instance. The role multiplier for edge infrastructure and the unauthenticated remote attack vector floor this at HIGH.

1. Disable HTTP/3 if not business-critical — Remove or comment out listen ... quic directives and add_header Alt-Svc entries in your NGINX config. This completely eliminates the attack surface with zero impact if you're not actively serving HTTP/3 traffic. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity, though if your NGINX instances are directly internet-facing on UDP/443, prioritize this within days.
2. Block UDP/443 at the network perimeter — If HTTP/3 is not required, drop inbound UDP/443 at the firewall or security group level. This prevents the QUIC handshake from ever reaching NGINX. Even if HTTP/3 is needed, ensure only CDN edge nodes or trusted sources can reach UDP/443 on your origin. Deploy within 30 days.
3. Upgrade to NGINX 1.31.2+ — The definitive fix. Version 1.31.2 moves the QPACK insert buffer allocation from stream-scoped to connection-scoped memory pools, eliminating the use-after-free. Apply within the 180-day noisgate remediation SLA for HIGH, but aim for your next maintenance window given the simplicity of the upgrade.
4. Monitor for worker process crashes — Set up alerting on repeated NGINX worker restarts via systemd journal, nginx_worker_restart metrics, or your APM. Sustained worker crashes on HTTP/3-enabled instances may indicate exploitation attempts. Deploy monitoring immediately as a detection backstop.
5. Ensure ASLR is enabled — Verify /proc/sys/kernel/randomize_va_space is set to 2 (full randomization) on all NGINX hosts. This is the default on modern Linux but can be disabled by misconfiguration or legacy tuning. This eliminates the RCE path entirely, leaving only DoS as the realistic impact.

Run this script on each NGINX host as any user with read access to the NGINX binary. Usage: bash check_cve_2026_42530.sh — no arguments needed. The script checks the compiled NGINX version and whether HTTP/3 is enabled in the running configuration.

#!/usr/bin/env bash
# CVE-2026-42530 Checker — NGINX HTTP/3 QPACK Use-After-Free
# Run on: target NGINX host
# Privileges: read access to nginx binary and config
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

NGINX_BIN=$(command -v nginx 2>/dev/null || echo "/usr/sbin/nginx")

if [[ ! -x "$NGINX_BIN" ]]; then
  echo "UNKNOWN — nginx binary not found at $NGINX_BIN"
  exit 2
fi

# Get version
VERSION_OUTPUT=$($NGINX_BIN -v 2>&1)
VERSION=$(echo "$VERSION_OUTPUT" | grep -oP 'nginx/\K[0-9]+\.[0-9]+\.[0-9]+')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse nginx version from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected NGINX version: $VERSION"

# Check if HTTP/3 module is compiled in
HAS_HTTP3=false
if $NGINX_BIN -V 2>&1 | grep -q 'http_v3_module'; then
  HAS_HTTP3=true
  echo "HTTP/3 module: COMPILED IN"
else
  echo "HTTP/3 module: NOT compiled in"
fi

# Check if quic is in running config
QUIC_ENABLED=false
CONFIG_FILE=$($NGINX_BIN -t 2>&1 | grep -oP 'configuration file \K[^ ]+' || echo "/etc/nginx/nginx.conf")
if [[ -r "$CONFIG_FILE" ]] && grep -rq 'listen.*quic' /etc/nginx/ 2>/dev/null; then
  QUIC_ENABLED=true
  echo "QUIC listener: ENABLED in config"
else
  echo "QUIC listener: not found in config"
fi

# Check ASLR status
ASLR=$(cat /proc/sys/kernel/randomize_va_space 2>/dev/null || echo "unknown")
echo "ASLR status: $ASLR (2=full, 1=partial, 0=disabled)"

# Version comparison
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

if [[ "$MAJOR" -eq 1 && "$MINOR" -eq 31 && ( "$PATCH" -eq 0 || "$PATCH" -eq 1 ) ]]; then
  if [[ "$HAS_HTTP3" == true && "$QUIC_ENABLED" == true ]]; then
    echo "VULNERABLE — NGINX $VERSION with HTTP/3 enabled. CVE-2026-42530 applies. Upgrade to 1.31.2+."
    exit 1
  elif [[ "$HAS_HTTP3" == true ]]; then
    echo "VULNERABLE — NGINX $VERSION has HTTP/3 compiled in but QUIC not detected in config. Exploitation unlikely but upgrade recommended."
    exit 1
  else
    echo "PATCHED (effectively) — NGINX $VERSION but HTTP/3 module not compiled in. Not exploitable."
    exit 0
  fi
else
  echo "PATCHED — NGINX $VERSION is not in the affected range (1.31.0–1.31.1)."
  exit 0
fi

Sources

1. F5 NGINX Security Advisory K000161616
2. NGINX Official Security Advisories
3. SOCRadar — CVE-2026-42530 & CVE-2026-42055 Analysis
4. SecurityArsenal — Detection and Remediation Guide
5. Penligent — QPACK Use-After-Free Technical Deep Dive
6. 0xBlackash/CVE-2026-42530 Safe Checker (GitHub)
7. The Hacker News — F5 Patches Two Critical NGINX Flaws
8. CSA Singapore — High-Severity NGINX Alert