CVE-2026-42530

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

NGINX Open Source has a vulnerability in the ngxhttpv3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.17.0"
                },
                {
                    "last_affected": "2.22.0"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "f5:nginx_instance_manager",
            "cpes": [
                "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "f5:nginx_ingress_controller",
            "cpes": [
                "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git

github.com/nginx/kubernetes-ingress

Affected ranges

Type

GIT

Repo

https://github.com/nginx/kubernetes-ingress

Events

Introduced

33971b8ff54bc55785a7b38c07a21e03bda25080

Last affected

561824f3077b7615c2fa764bd6d8e7a47e184857

Introduced

8dfabca757830d0821e86206c2db83044e6696f0

Fixed

814710cbaf43c9a37baed249feec0db5f0868fa9

Introduced

81bae7d0360fdf277b2d3e355d02e410ee211ef8

Last affected

43349033e28d0b6aa38773ff840deba079654a4f

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "last_affected": "3.7.2"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.5.1"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "4.0.1"
        }
    ]
}

Affected versions

4.*

4.0.0

4.0.1

v4.*

v4.0.0

v4.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42530.json"

github.com/nginx/nginx

Affected ranges

Type

GIT

Repo

https://github.com/nginx/nginx

Events

Introduced

e8053c867f9ab14f323e3019ccab585d857abb66

Fixed

2fd01ed47a1fd2965754c83f53b33a789d0e07f1

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.31.0"
        },
        {
            "fixed": "1.31.2"
        }
    ]
}

Affected versions

release-1.*

release-1.31.0

release-1.31.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42530.json"

github.com/nginx/nginx-gateway-fabric

Affected ranges

Type

GIT

Repo

https://github.com/nginx/nginx-gateway-fabric

Events

Introduced

3a372747333fb1db372af7cf0b18ed7eef7c91f7

Last affected

532db6a20b2912fe397211eef9f8d564d46a4bdd

Introduced

7dad8b31e3f0c3eadce36fed8c276e83e6583d24

Fixed

66691213cd771fe56b124786ea6701c7fb8e467a

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "last_affected": "1.6.2"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.6.4"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42530.json"