NGINX HTTP/3 QPACK Use After Free (CVE-2026-42530): Brief Summary of a Critical Remote Vulnerability

Introduction

A newly disclosed Use After Free in NGINX's HTTP/3 QPACK implementation lets a remote, unauthenticated attacker crash worker processes and, under the right conditions, execute code on the world's most widely deployed web server. NGINX powers 32.8% of all websites with a known web server, and the recent CVE-2026-42945 was exploited in the wild within four days of disclosure. Organizations running NGINX 1.31.x with HTTP/3 enabled should evaluate their exposure immediately.

Technical Information

Root Cause: Use After Free in QPACK Encoder Stream Handling

CVE-2026-42530 is classified as CWE-416 (Use After Free) and sits in NGINX's ngx_http_v3_module, the module that handles HTTP/3 (QUIC) support. F5 Networks, acting as the CNA, published it on June 17, 2026. It carries a CVSS v4.0 score of 9.2 Critical (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and a CVSS v3.1 score of 8.1 High.

HTTP/3 uses QPACK (defined in RFC 9204) to compress header fields. QPACK works through two dedicated unidirectional streams, an encoder stream and a decoder stream, and the specification says each endpoint opens exactly one of each per HTTP/3 session. The protocol's correctness depends on that invariant.

The bug triggers when a specially crafted HTTP/3 session gets the QPACK encoder stream reopened after it has already been closed or its associated memory has been freed. NGINX then processes the reopened stream and dereferences a pointer to memory that has already been deallocated. This is a classic Use After Free. The freed region may have been reallocated for a different purpose, so any read or write through the stale pointer either corrupts the new data or follows attacker-controlled values.

Impact: Denial of Service and Conditional RCE

The immediate, reliably achievable impact is denial of service. The Use After Free crashes the NGINX worker process, which then restarts. The attacker needs nothing beyond network access and an HTTP/3-enabled configuration to get this result.

Remote code execution is the more severe impact, and it requires additional conditions that the F5 advisory describes as "beyond the attacker's control." Either ASLR must be disabled on the target system, or the attacker must have a separate way to bypass ASLR, for example through an information leak vulnerability.

When ASLR is absent or defeated, the attacker can predict the memory layout and craft the contents of the freed region to redirect execution flow. That turns the Use After Free from a crash into a controlled write primitive suitable for code execution.

Attack Flow

Based on the advisory details, an attack would proceed as follows:

1. The attacker identifies an NGINX instance that accepts HTTP/3 connections, either from the Alt-Svc header or by probing UDP port 443 for QUIC responses.

2. The attacker opens a standard HTTP/3 QUIC session with the target server.

3. Within the session, the attacker sends a crafted sequence of QUIC frames that closes the QPACK encoder stream and then reopens it. The framing that does this exploits a logic error in ngx_http_v3_module's stream lifecycle management.

4. NGINX processes the reopened encoder stream and accesses freed memory. That alone is enough for DoS, because the worker process crashes.

5. If ASLR is disabled, the attacker can arrange for the freed memory to be reallocated with attacker-controlled content before the stale pointer is dereferenced. That enables arbitrary code execution in the context of the NGINX worker process.

The F5 advisory confirms this is a data plane issue only. The NGINX control plane is not exposed through this vulnerability.

CVSS Breakdown

Both scoring systems rate attack complexity as High, which reflects the conditions beyond the attacker's control and the ASLR requirement for full exploitation.

Affected Systems and Versions

Only a narrow set of NGINX Open Source versions is vulnerable, but the flaw carries into multiple downstream F5 products.

NGINX Open Source

Only the 1.31.x mainline branch is affected:

Organizations running the NGINX stable branch (1.30.x and earlier) are not affected by this specific CVE. Per F5's policy, software versions that have reached End of Technical Support (EoTS) are not evaluated.

Downstream F5 Products

Required Configuration

The vulnerability is only exploitable when HTTP/3 QUIC is enabled, which means the listen directive must include the quic parameter:

listen 443 quic reuseport;

Instances without quic in their listen directives never reach the vulnerable ngx_http_v3_module code path and are not at risk.

Mitigation

The F5 advisory gives one explicit workaround, which is to remove quic from all listen directives. For example, change:

listen 443 quic reuseport;

to:

listen 443 ssl;

That removes the vulnerable code path entirely. The definitive fix is upgrading to NGINX Open Source 1.31.2 or later.

Other defense-in-depth measures worth implementing:

• Verify ASLR is enabled on all NGINX hosts. On Linux, check with cat /proc/sys/kernel/randomize_va_space (the value should be 2). This does not prevent the DoS scenario but blocks the RCE path.
• Restrict UDP port 443 at the network perimeter to limit QUIC exposure where you cannot patch immediately.
• Monitor for repeated worker process restarts, which may indicate active exploitation attempts.
• Inventory all NGINX-derived products across your environment, including Kubernetes ingress controllers, API gateways, and management planes that embed NGINX.

Vendor Security History

2026 has been a busy year for NGINX security disclosures. CVE-2026-42530 is the eighth NGINX CVE disclosed this year:

The May 13 disclosure batch alone included seven CVEs, published under F5's Quarterly Security Notification. The most consequential, CVE-2026-42945 (dubbed "NGINX Rift"), was an 18-year-old heap buffer overflow in the rewrite module. VulnCheck confirmed active exploitation within four to five days of disclosure. Security researcher Kevin Beaumont noted that RCE for that vulnerability also required ASLR to be disabled, a condition that parallels CVE-2026-42530.

The HTTP/3 QUIC module in particular has been a recurring source of vulnerabilities. Counting CVE-2026-42530, there have been at least eight HTTP/3-related CVEs across 2024 and 2026:

This pattern suggests that NGINX's HTTP/3 implementation is still an immature attack surface. A relatively new protocol, complex stream management across the QPACK encoder and decoder streams, and manual memory management in C together leave plenty of room for memory corruption flaws. Organizations should evaluate whether HTTP/3 is operationally necessary for their deployments and consider disabling it where the performance benefits do not justify the extra attack surface.

The CSA (Cyber Security Agency) of Singapore has also issued advisories covering the May 2026 F5 vulnerabilities.

References

• NVD: CVE-2026-42530
• F5 Advisory: NGINX ngx_http_v3_module vulnerability CVE-2026-42530 (K000161616)
• RFC 9204: QPACK Field Compression for HTTP/3
• F5 Quarterly Security Notification (May 2026)
• NGINX Security Advisories
• NGINX News: 2026
• NGINX Downloads
• CISA Known Exploited Vulnerabilities Catalog
• F5 Advisory: NGINX ngx_quic_module vulnerability CVE-2026-40460
• CSA Singapore: Multiple Vulnerabilities in F5 NGINX, BIG-IP and BIG-IQ
• The Hacker News: NGINX CVE-2026-42945 Exploited in the Wild
• Help Net Security: Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945)
• runZero: F5 NGINX vulnerability: Find impacted systems
• QPACK How To: nghttp3 documentation
• F5 Advisory: NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945