PT-2026-50439 · F5 · Nginx Open Source

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-42530

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Open Source versions 1.31.0 through 1.31.1

Description A use-after-free flaw exists in the ngx http v3 module module when the software is configured to use the HTTP/3 QUIC module. A remote unauthenticated attacker can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream, which may cause the NGINX worker process to restart. This issue can also lead to code execution on systems where Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas of a process—is disabled or bypassed. Exploitation depends on conditions beyond the attacker's control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-42530

Affected Products

Nginx Open Source

References · 3

• https://my.f5.com/manage/s/article/K000161616 · Vendor Advisory
• https://twitter.com/jedisct1/status/2067287414410719676 · Twitter Post
• https://twitter.com/UpwindMDR/status/2067304589699715263 · Twitter Post