CVE-2026-42530: NGINX Open-Source ngx_http_v3_module vulnerability

Synopsis

A use-after-free vulnerability exists in the ngx_http_v3_module of NGINX Open Source (versions 1.31.0 up to 1.31.2). A remote, unauthenticated attacker can send a specially crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, triggering the bug. Successful exploitation causes a worker-process crash, and on systems where ASLR is disabled or can be bypassed, the attacker achieves remote code execution. A patched-image rebuild at version 1.31.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NGINX service over the network by sending a crafted HTTP/3 QUIC session to an exposed listener.

• AuthenticationNot required

  No account or credential is needed; the exploit is available to any unauthenticated remote client.

• Victim interactionNot required

  The attacker interacts directly with the NGINX service and no user action is required to trigger the vulnerability.

• Attack complexityDetail

  Exploitation requires conditions beyond the attacker's direct control (such as ASLR being disabled or separately bypassed), making reliable code execution dependent on environmental factors rather than a straightforward, condition-free exploit path.

Blast Radius

• Crashes the targeted NGINX worker process, forcing a restart and interrupting in-flight HTTP/3 connections.
• On systems with ASLR disabled or where the attacker can bypass ASLR, executes arbitrary code in the context of the NGINX worker process.
• Compromises confidentiality of data handled by the worker, including proxied request and response content in memory at the time of exploitation.
• Allows modification of in-memory state within the worker process, potentially corrupting responses served to other active clients.