Use-after-free in NGINX Open Source - CVE-2026-42530
Published: June 18, 2026
Vulnerability identifier: #VU134863
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42530
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to use-after-free in the ngx_http_v3_module when processing a specially crafted HTTP/3 session that reopens a QPACK encoder stream. A remote attacker can send a specially crafted HTTP/3 session to execute arbitrary code or cause a denial of service.
Exploitation requires NGINX Open Source to be configured to use the HTTP/3 QUIC module. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. There is no control plane exposure; this is a data plane issue only.
Affected software
NGINX Open Source
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx
How to mitigate CVE-2026-42530
Install security update from vendor's website.
NGINX Open Source - update to 1.31.2
nginx-mod-js-challenge - addressed in versions 0^20230517.gitda6852d-9.fc44, 0^20230517.gitda6852d-9.fc45
nginx-mod-vts - addressed in versions 0.2.4-11.fc43, 0.2.4-11.fc44, 0.2.4-11.fc45
nginx-mod-fancyindex - addressed in versions 0.6.0-6.fc43, 0.6.0-6.fc44, 0.6.0-6.fc45
nginx-mod-headers-more - addressed in versions 0.39-11.fc43, 0.39-11.fc44, 0.39-11.fc45
nginx-mod-brotli - addressed in versions 1.0.0~rc-11.fc43, 1.0.0~rc-11.fc44, 1.0.0~rc-11.fc45
nginx-mod-modsecurity - addressed in versions 1.0.4-12.fc43, 1.0.4-12.fc44, 1.0.4-12.fc45
nginx-mod-naxsi - addressed in versions 1.6-19.fc43, 1.6-19.fc44, 1.6-19.fc45
nginx - addressed in versions 1.30.3-1.fc43, 1.30.3-1.fc44, 1.30.3-1.fc45
nginx-mod-js-challenge - addressed in versions 0^20230517.gitda6852d-9.fc44, 0^20230517.gitda6852d-9.fc45
nginx-mod-vts - addressed in versions 0.2.4-11.fc43, 0.2.4-11.fc44, 0.2.4-11.fc45
nginx-mod-fancyindex - addressed in versions 0.6.0-6.fc43, 0.6.0-6.fc44, 0.6.0-6.fc45
nginx-mod-headers-more - addressed in versions 0.39-11.fc43, 0.39-11.fc44, 0.39-11.fc45
nginx-mod-brotli - addressed in versions 1.0.0~rc-11.fc43, 1.0.0~rc-11.fc44, 1.0.0~rc-11.fc45
nginx-mod-modsecurity - addressed in versions 1.0.4-12.fc43, 1.0.4-12.fc44, 1.0.4-12.fc45
nginx-mod-naxsi - addressed in versions 1.6-19.fc43, 1.6-19.fc44, 1.6-19.fc45
nginx - addressed in versions 1.30.3-1.fc43, 1.30.3-1.fc44, 1.30.3-1.fc45
External References
Related Security Bulletins
- Multiple vulnerabilities in NGINX
- Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
- Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
- Fedora 43 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts