Main
Vulnerability Database
Exploits
ID:12947 - Exploit for Use-after-free in NGINX Open Source - CVE-2026-42530
ID:12947 - Exploit for Use-after-free in NGINX Open Source - CVE-2026-42530
Published: August 21, 2026
Vulnerability identifier: #VU134863
Vulnerability risk: High
CVE-ID: CVE-2026-42530
CWE-ID: CWE-416
Exploitation vector: Remote access
Vulnerable software:
NGINX Open Source
Gentoo Linux
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx
www-servers/nginx
NGINX Open Source
Gentoo Linux
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx
www-servers/nginx
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to use-after-free in the ngx_http_v3_module when processing a specially crafted HTTP/3 session that reopens a QPACK encoder stream. A remote attacker can send a specially crafted HTTP/3 session to execute arbitrary code or cause a denial of service.
Exploitation requires NGINX Open Source to be configured to use the HTTP/3 QUIC module. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. There is no control plane exposure; this is a data plane issue only.
Remediation
Install security update from vendor's website.