CVE-2026-42530: NGINX HTTP/3 Use-After-Free Code Execution Vulnerability

Technical summary

The vulnerability exists in the ngx_http_v3_module component of NGINX Open Source and affects the HTTP/3 QUIC protocol handler. The root cause is a use-after-free condition (CWE-416) triggered when an attacker crafts an HTTP/3 session that causes the QPACK encoder stream to be reopened improperly. This leads to memory being accessed after it has been freed, causing the worker process to crash. On systems where ASLR is disabled or can be circumvented, the attacker gains control over the freed memory region, enabling arbitrary code execution in the context of the NGINX worker process. The vulnerability requires specific conditions beyond the attacker's direct control but is exploitable over the network without requiring authentication or user interaction.

Business impact

Organizations running NGINX Open Source with HTTP/3 QUIC support enabled face availability risk through denial-of-service attacks that restart worker processes. More critically, on systems with insufficient memory protections (disabled ASLR), this becomes a remote code execution vulnerability allowing attackers to execute arbitrary commands with NGINX worker privileges. This could lead to compromise of served content, lateral movement into backend systems, and data theft. The impact is heightened for CDNs, reverse proxies, and API gateways where NGINX serves as a critical entry point.

Affected systems

This vulnerability affects NGINX Open Source and the following F5 NGINX products: NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Any deployment running HTTP/3 QUIC support is vulnerable. Systems with ASLR disabled or circumventable are at elevated risk for code execution. Note that software versions at End of Technical Support (EoTS) are not evaluated per the vendor's guidance.

Exploitability

While the vulnerability requires specific conditions (AC:H in the CVSS vector), network accessibility and lack of authentication requirements make it practically exploitable. An attacker needs only to send crafted HTTP/3 packets and does not require credentials or user interaction. The primary barrier is the environmental condition (ASLR status or bypass capability), which is within an attacker's reach in many real-world scenarios. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting active exploitation may not yet be widespread, but organizations should not assume this provides protection.

Remediation

Upgrade NGINX Open Source and affected F5 products to patched versions released by F5. Verify the specific patch version for your product and version combination against F5's official security advisory. As an interim measure, disable HTTP/3 QUIC support in NGINX configuration if it is not operationally required. Additionally, ensure ASLR is enabled system-wide to raise the bar for exploitation even if the vulnerability is triggered. Monitor NGINX worker process logs for unexpected restarts that may indicate exploitation attempts.

Patch guidance

Consult F5's official security advisory for NGINX Open Source and the specific F5 NGINX product you operate (Ingress Controller, Gateway Fabric, or Instance Manager) to identify the patched version. Apply patches in a staged manner across non-production environments first to validate compatibility. Test HTTP/3 functionality after patching if it is in use. Establish a timeline to patch all affected instances within your infrastructure.

Detection guidance

Monitor NGINX worker process restart events and correlate with HTTP/3 (UDP port 443) traffic patterns from external sources. Log analysis tools should flag unexpected worker crashes without clear configuration errors. Intrusion detection systems may identify malformed HTTP/3 QUIC packets if they have QUIC protocol inspection capabilities. Implement netflow or packet capture analysis on production NGINX endpoints to baseline normal HTTP/3 session behavior and flag anomalies. Process memory monitoring tools can detect the characteristic patterns of use-after-free exploitation attempts.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH CVSS score (8.1), network accessibility, lack of authentication requirements, and potential for code execution on insufficiently hardened systems. Even where ASLR is enabled, the denial-of-service impact through worker process crashes affects availability. Organizations running NGINX in reverse proxy or API gateway roles should prioritize patching and interim mitigation immediately. The fact that it is not yet in the KEV catalog should not delay action—vulnerability disclosure and exploitation often follow different timelines.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects the combination of high impact (confidentiality, integrity, and availability all scored as high), network vector (remote exploitation), no authentication requirement, and user interaction not required. The score is tempered by the AC:H (high attack complexity) due to environmental conditions that must align for full code execution. However, the baseline denial-of-service impact is achievable under simpler conditions, making the vulnerability dangerous even where ASLR mitigations are present.

Frequently asked questions