CVE-2026-42530

NGINX Open-Source ngx_http_v3_module vulnerability

No known exploitation. EPSS puts it in the 65th percentile. A vendor fix is available.

CVSS 3.18.1High EPSS percentile65th1.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-17Updated 2026-07-16Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your F5 NGINX Open Source is configured with the HTTP/3 QUIC module (ngx_http_v3_module). 2) Update NGINX Open Source to the patched version your vendor provides (ask your IT/NGINX maintainer to confirm the exact target version). 3) After updating, verify HTTP/3 is still configured as intended and monitor NGINX for restarts or unusual HTTP/3 traffic.

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

In plain language

Written by AI from the record

CVE-2026-42530 is a high-impact bug in F5 NGINX Open Source when HTTP/3 (QUIC) is enabled, where a crafted network session can crash NGINX and potentially lead to more serious consequences; if you run F5 NGINX Open Source with HTTP/3 enabled, you should act soon.

What is it

This vulnerability is in NGINX’s HTTP/3 “front door” (QUIC). If HTTP/3 is turned on, a remote person can send a specially made “conversation” that can cause NGINX to mishandle memory, which can restart the service; in some cases, it may be possible to go further depending on system protections like ASLR. Think of it like a server that has a bug in how it processes a particular type of handshake—certain crafted handshakes can cause the server to fall over.

Who is affected

This matters to you if you use or run F5 NGINX Open Source with the HTTP/3 QUIC module enabled. If you do not use HTTP/3 (or don’t have the QUIC module configured), you may not be exposed to this specific issue. The problem is specifically described for NGINX Open Source’s ngx_http_v3_module, not for every NGINX setup.

How urgent is it

This is an AMBER issue because the bug is new and tied to an externally reachable feature (HTTP/3), and it can at minimum cause NGINX worker restarts. There is no public exploit and no known exploited-in-the-wild reporting provided here, so it is not an immediate “everyone is being attacked right now” situation—but you should patch promptly to prevent disruption and reduce the chance of more advanced misuse.

What to do — in detail

Identify exposure:

Confirm the NGINX build and configuration include the HTTP/3 QUIC module (ngx_http_v3_module).
Confirm HTTP/3 is actually enabled and reachable (for example, you terminate HTTP/3 at this NGINX instance).
Ensure the running version is not beyond End of Technical Support; EoTS versions are noted as not evaluated.

Patch:

Obtain and install the vendor’s fix for CVE-2026-42530 for F5 NGINX Open Source.
If you manage multiple instances, roll out the update across them in a controlled sequence (starting with public-facing nodes).
Plan a brief maintenance window if your environment requires restarts to apply the update.

If you cannot patch immediately (temporary mitigation):

Disable HTTP/3 / the QUIC HTTP/3 module on the affected NGINX instances until the patched update is deployed.
Keep HTTP/2 or HTTP/1.1 available if your service supports it, so clients are not fully blocked.

Validate and monitor:

After deploying the fix (or mitigation), confirm HTTP/3 behavior is normal (no unexpected errors during HTTP/3 sessions).
Monitor NGINX logs and system/process health for signs of worker restarts (service interruption is mentioned as a possible outcome).
Watch for any unusual spikes in HTTP/3-related connection attempts.

Hardening considerations (for more technical readers):

The description notes risk increases when Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Ensure your OS and deployment keep ASLR enabled and that nothing in your hardening/debug setup weakens it.

Technical context

CVE-2026-42530 affects F5 NGINX Open Source in the ngx_http_v3_module. The issue occurs when NGINX is configured to use the HTTP/3 QUIC module: a remote unauthenticated attacker, under conditions beyond their control, can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This can trigger a Use-after-Free in the NGINX worker process leading to a restart; additionally, the description states that code execution may be possible if Address Space Layout Randomization (ASLR) is disabled or bypassed.

Severity/impact: Rated HIGH (CVSS 8.1 provided), with the most immediate practical impact being process instability (worker restarts) and potential escalation in certain environments.

Exploitation status: No public exploit available is reported, no CISA KEV inclusion is reported, and press attention is noted as “new, reason: patch.” Press indicates exploitation status (from press): none.

Attack vector: Remote, unauthenticated network interaction over HTTP/3 (QUIC), requiring HTTP/3 to be enabled and the crafted session behavior to line up with the vulnerability conditions.

KEV/EPSS note: This prompt only provides KEV status (not in KEV) and does not provide EPSS values or KEV/EPSS definitions; generally, “KEV” means the issue is listed as known to be exploited, but for this CVE it is not yet known exploited-in-the-wild per the provided info.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS65th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.1% chance of exploitation activity in the next 30 days, which ranks it in the 65th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 29 days, from the signal feeds we watch.

2026-07-16Patch availablerecord updated
2026-07-15Patch availablerecord updated
2026-07-02Patch availablerecord updated
2026-06-25OpenVAS check added
2026-06-17Publishedweakness classified, att&ck mapped

Affected products

F5commercial · US
- nginx gateway fabricNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- nginx ingress controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- nginx instance managerOn-premNetworking Infrastructure / load-balancer-proxy
- NGINX Open SourceWeb AppOn-premNetworking Infrastructure / load-balancer-proxy
NGINX Inc.commercial · USaka njs, nginx plus, nginx

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable