---
id: CVE-2026-42530
title: "NGINX Open Source has a vulnerability in the ngx_http_v3_module\_module"
summary: "NGINX Open Source has a vulnerability in the ngx_http_v3_module\_module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially …"
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
  - CWE-416
vendor: f5
product: nginx_gateway_fabric
affected:
  - 'nginx_gateway_fabric >= 1.3.0, <= 1.6.2'
  - 'nginx_gateway_fabric >= 2.0.0, < 2.6.4'
  - 'nginx_ingress_controller >= 3.5.0, <= 3.7.2'
  - 'nginx_ingress_controller >= 5.0.0, < 5.5.1'
  - nginx_ingress_controller = 4.0.0
  - nginx_ingress_controller = 4.0.1
  - 'nginx_instance_manager >= 2.17.0, <= 2.22.0'
  - 'nginx_open_source >= 1.31.0, < 1.31.2'
patched:
  - nginx_gateway_fabric 2.6.4
  - nginx_ingress_controller 5.5.1
  - nginx_open_source 1.31.2
published: '2026-06-17'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42530'
references:
  - url: 'https://my.f5.com/manage/s/article/K000161616'
    label: f5sirt@f5.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42530'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489872'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - exploit-available
epss: 0.01145
epssPercentile: 0.65368
ingestedAt: '2026-07-03T13:02:27.796Z'
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/v4ltonn/CVE-2026-42530'
    - 'https://github.com/0xBlackash/CVE-2026-42530'
    - 'https://github.com/HORKimhab/CVE-2026-42530'
  checkedAt: '2026-09-26T09:05:43.944Z'
exploitAvailable: true
---

## Overview

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Affected

- `nginx_gateway_fabric >= 1.3.0, <= 1.6.2`
- `nginx_gateway_fabric >= 2.0.0, < 2.6.4`
- `nginx_ingress_controller >= 3.5.0, <= 3.7.2`
- `nginx_ingress_controller >= 5.0.0, < 5.5.1`
- `nginx_ingress_controller = 4.0.0`
- `nginx_ingress_controller = 4.0.1`
- `nginx_instance_manager >= 2.17.0, <= 2.22.0`
- `nginx_open_source >= 1.31.0, < 1.31.2`

## Remediation

Upgrade past the affected range:

- `nginx_gateway_fabric 2.6.4`
- `nginx_ingress_controller 5.5.1`
- `nginx_open_source 1.31.2`