NGINX Open Source ngx_http_v3_module QPACK Encoder Stream Use-After-Free

#!/usr/bin/env bash
# check_cve_2026_42530.sh — Detect CVE-2026-42530 exposure
# Checks: (1) NGINX version in affected range, (2) HTTP/3 module compiled in, (3) HTTP/3 enabled in config
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

NGINX_BIN="${1:-$(command -v nginx 2>/dev/null || echo '')}"

if [[ -z "$NGINX_BIN" ]]; then
  echo "UNKNOWN — nginx binary not found in PATH. Pass path as argument."
  exit 2
fi

# Get version
VER_LINE=$($NGINX_BIN -v 2>&1 || true)
VER=$(echo "$VER_LINE" | grep -oP 'nginx/\K[0-9]+\.[0-9]+\.[0-9]+' || echo '')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN — could not parse NGINX version from: $VER_LINE"
  exit 2
fi

echo "[*] NGINX version: $VER"

# Check if version is in affected range (1.31.0 or 1.31.1)
case "$VER" in
  1.31.0|1.31.1)
    AFFECTED=1
    ;;
  *)
    echo "PATCHED — version $VER is outside affected range (1.31.0–1.31.1)."
    exit 0
    ;;
esac

# Check if http_v3_module is compiled in
BUILD_FLAGS=$($NGINX_BIN -V 2>&1 || true)
if echo "$BUILD_FLAGS" | grep -q 'http_v3_module'; then
  echo "[!] HTTP/3 module (ngx_http_v3_module) is compiled into this binary."
  H3_COMPILED=1
else
  echo "PATCHED — version $VER is affected but ngx_http_v3_module is NOT compiled in. Not exploitable."
  exit 0
fi

# Check if HTTP/3 is enabled in running config
CONFIG_DUMP=$($NGINX_BIN -T 2>/dev/null || echo 'CONFIG_UNREADABLE')
if [[ "$CONFIG_DUMP" == "CONFIG_UNREADABLE" ]]; then
  echo "VULNERABLE — version $VER with http_v3_module compiled in. Could not read config to check if HTTP/3 is active (run as root or nginx user). Assume vulnerable."
  exit 1
fi

if echo "$CONFIG_DUMP" | grep -qE 'listen.*quic|http3\s+on'; then
  echo "VULNERABLE — NGINX $VER with HTTP/3 (QUIC) enabled in configuration. CVE-2026-42530 is exploitable."
  exit 1
else
  echo "PATCHED — version $VER with http_v3_module compiled in but HTTP/3 is NOT enabled in config. Not currently exploitable."
  exit 0
fi