CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2026-42530

High · CVSS 8.1

NGINX Open Source — Use-after-Free (UAF) in HTTP/3 QUIC QPACK encoder stream handling leading to worker process restart or RCE

CVSS
8.1
nvd
EPSS
—
KEV
No
Class
other
CWE-416, CWE-416

Description

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Search profile — drives PoC discovery

Symbols ngx_http_v3_modulengx_http_v3_sessionQPACK encoder streamngx_http_v3_parse_encoderngx_http_quic_modulengx_http_v3_cleanup_sessionreopenencoder streamQUICHTTP/3
Keywords CVE-2026-42530NGINX HTTP/3 use-after-freeNGINX QUIC QPACK UAFngx_http_v3_module exploitNGINX QPACK encoder stream reopenNGINX HTTP3 worker crash RCENGINX QUIC vulnerability PoCnginx uaf http3 quicK000161616 NGINXNGINX ASLR bypass HTTP3
Versions: NGINX Open Source versions supporting HTTP/3 QUIC (pre-patch; EoTS versions excluded)

Ranked PoCs (3) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-03T00:00:43.000Z · profiled 2026-07-03T00:30:43.000Z