CVE-2026-42530: NGINX HTTP/3 Use-After-Free Vulnerability

CVE-2026-42530 Overview

CVE-2026-42530 is a use-after-free vulnerability [CWE-416] in the ngx_http_v3_module of NGINX Open Source. The flaw exists when NGINX is configured to use the HTTP/3 QUIC module. A remote unauthenticated attacker can send a specially crafted HTTP/3 session that reopens a QPACK encoder stream, triggering the use-after-free condition in the NGINX worker process.

Exploitation typically causes the worker process to restart, resulting in service disruption. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, attackers can leverage the flaw to achieve code execution.

Critical Impact
Remote unauthenticated attackers can crash NGINX worker processes or execute arbitrary code against HTTP/3-enabled servers when ASLR is disabled or bypassed.

Affected Products

NGINX Open Source configured with the HTTP/3 QUIC module (ngx_http_v3_module)
Supported NGINX versions remain affected per the F5 advisory; End of Technical Support releases were not evaluated
Refer to the F5 Support Article K000161616 for the complete affected version matrix

Discovery Timeline

2026-06-17 - CVE-2026-42530 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-42530

Vulnerability Analysis

The vulnerability resides in NGINX's HTTP/3 implementation, specifically in how the ngx_http_v3_module manages QPACK encoder streams within a QUIC session. QPACK is the header compression mechanism mandated by HTTP/3, and it relies on a dedicated unidirectional encoder stream per connection.

An attacker initiates a valid HTTP/3 session, then issues a specially crafted sequence that causes NGINX to reopen the QPACK encoder stream. The module fails to correctly track the lifecycle of the previously allocated encoder state, leaving a dangling reference to freed memory.

When NGINX subsequently processes data on the reopened stream, it dereferences the freed object inside the worker process. This produces an immediate crash and worker restart in most environments. Where ASLR is disabled or bypassed, attackers can shape heap state to convert the dangling reference into arbitrary code execution within the worker context.

Root Cause

The root cause is improper object lifetime management in the QPACK encoder stream handling path. The module permits a peer-driven state transition (stream reopen) without releasing or revalidating the prior allocation, producing a classic use-after-free [CWE-416].

Attack Vector

The attack is network-based, requires no authentication, and no user interaction. The advisory notes additional conditions outside the attacker's direct control must align for successful exploitation, which is reflected in the high attack complexity rating. Any internet-facing NGINX deployment serving HTTP/3 is reachable.

No verified public proof-of-concept code is available. See the F5 Support Article K000161616 for vendor technical details.

Detection Methods for CVE-2026-42530

Indicators of Compromise

Repeated NGINX worker process crashes or restarts logged in error.log with signals such as SIGSEGV or SIGABRT correlated with HTTP/3 traffic
Unusual QUIC connections that open, close, and reopen QPACK encoder streams within a single session
Spikes in QUIC connection churn from a small set of source IP addresses targeting UDP/443

Detection Strategies

Inspect QUIC traffic for anomalous QPACK encoder stream patterns, particularly multiple encoder stream initializations within one connection
Monitor NGINX error.log for worker process exited on signal messages and correlate timestamps with HTTP/3 client activity
Alert on unexpected child process restarts of the nginx master via host telemetry

Monitoring Recommendations

Forward NGINX access and error logs into a centralized analytics platform and create rules for worker crash frequency thresholds
Capture QUIC flow metadata at edge devices to identify scanning or fuzzing behavior targeting HTTP/3 endpoints
Track CPU and memory anomalies on NGINX hosts that may indicate exploitation attempts beyond simple crashes

How to Mitigate CVE-2026-42530

Immediate Actions Required

Apply the fixed NGINX Open Source release identified in the F5 Support Article K000161616 as soon as it is available for your distribution
Inventory all NGINX deployments and identify any configuration that enables the HTTP/3 QUIC listener (listen ... quic)
Verify that ASLR is enabled on all hosts running NGINX to raise the bar against code execution
Restrict exposure of UDP/443 to required clients only while patching is in progress

Patch Information

F5 has published guidance and fixed version information in the F5 Support Article K000161616. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported, patched release.

Workarounds

Disable HTTP/3 by removing quic from listen directives and reloading NGINX until patching is complete
Block or rate-limit inbound UDP/443 at the perimeter where HTTP/3 is not required
Ensure kernel-level ASLR remains enabled (kernel.randomize_va_space=2 on Linux) to prevent reliable code execution

bash

# Disable HTTP/3 listener as a temporary workaround
# /etc/nginx/conf.d/example.conf
server {
    listen 443 ssl;            # keep TCP TLS
    # listen 443 quic reuseport; # comment out HTTP/3 QUIC listener
    # add_header Alt-Svc 'h3=":443"; ma=86400';
    server_name example.com;
}

# Verify ASLR is enabled on Linux hosts
sysctl kernel.randomize_va_space
# expected output: kernel.randomize_va_space = 2

# Reload NGINX after configuration change
nginx -t && systemctl reload nginx