NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
| Link | Resource |
|---|---|
| https://my.f5.com/manage/s/article/K000161616 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2026:20351 | |
| https://access.redhat.com/security/cve/CVE-2026-42530 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2489872 | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jul 2026, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* |
|
| First Time |
F5 nginx Gateway Fabric
F5 nginx Open Source F5 nginx Ingress Controller F5 nginx Instance Manager F5 |
|
| References | () https://my.f5.com/manage/s/article/K000161616 - Vendor Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2026-42530 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2489872 - Third Party Advisory | |
| References | () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json - Third Party Advisory |
30 Jun 2026, 03:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Jun 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-17 15:16
Updated : 2026-07-16 12:17
NVD link : CVE-2026-42530
Mitre link : CVE-2026-42530
CVE.ORG link : CVE-2026-42530
JSON object : View
Products Affected
f5
- nginx_ingress_controller
- nginx_gateway_fabric
- nginx_instance_manager
- nginx_open_source
CWE
CWE-416
Use After Free