F5 NGINX Open Source · Public exploit code

PoC disclosed: use-after-free in NGINX HTTP/3 module (CVE-2026-42530)

Oct 28, 2026 · 1 min read

A proof of concept has been disclosed for CVE-2026-42530, a use-after-free in the ngx_http_v3_module of F5 NGINX Open Source. According to the advisory, a remote unauthenticated attacker can cause the NGINX worker process to restart and execute code on systems with ASLR disabled; the flaw requires the HTTP/3 QUIC module to be enabled. The sources cite no fixed version, so teams running HTTP/3 on NGINX should track the vendor advisory.

By HIFY Radar newsroom Updated 10/28/2026 06:32 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A proof of concept has been disclosed for CVE-2026-42530, a use-after-free in the HTTP/3 module of F5 NGINX Open Source. The flaw only applies to deployments with the HTTP/3 QUIC module enabled and depends on conditions beyond the attacker's control. With the PoC in circulation, risk rises for anyone using that configuration.

Why it matters

According to the advisory, a remote unauthenticated attacker can crash and restart the NGINX worker process, affecting the availability of web services. On systems with ASLR disabled, or when the attacker can bypass ASLR, code execution is possible, which could compromise the server.

What to do

Identify where NGINX Open Source runs with the HTTP/3 QUIC module (ngx_http_v3_module) enabled, prioritizing internet-facing servers. Track the F5 advisory and apply the fix once released. Since the sources cite no fix, consider disabling HTTP/3 QUIC on affected instances until a patch exists.

For the technical team

CVE: CVE-2026-42530
Affected: F5 NGINX Open Source (ngx_http_v3_module, HTTP/3 sobre QUIC) · F5 NGINX Open Source configured to use the HTTP/3 QUIC module. The source lists no specific versions; versions that reached End of Technical Support (EoTS) were not evaluated.
Exploitation: PoC/exploit disclosed, per the dbugs feed (@ptdbugs, advisory PT-2026-50439). The sources report no in-the-wild exploitation and no KEV listing.
Fix: The sources cite no fixed versions, patch, or official mitigation.
Vector: Use-after-free in the ngx_http_v3_module. A remote unauthenticated attacker uses a specially crafted HTTP/3 session to reopen the QPACK encoder stream. Preconditions: HTTP/3 QUIC module enabled in NGINX and conditions beyond the attacker's control.
More details: The use-after-free occurs in the NGINX worker process and leads to a restart. Code execution is additionally possible on systems with ASLR disabled or when the attacker can bypass ASLR. Incident opened on 2026-10-28. dbugs advisory ID: PT-2026-50439.