CVE-2026-42530Patch(f5 / nginx_gateway_fabric)

CRITICALCVSS 9.2 · CRITICAL

Exploitation observed; activity peaked at 22 mentions and remains active

Immediate actions

Patch f5 nginx_gateway_fabric systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

f5 CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://access.redhat.com/errata/RHSA-2026:20351

Weakness type (CWE)

CWE-416

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nginx_gateway_fabric
nginx_ingress_controller
nginx_instance_manager
nginx_open_source

Threat summary

Active exploitation appears in 5 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
77 mentions across 22 observed days

What's happening

Active exploitation reported across 5 signals
Exploit tool or code specified in 6 signals
PoC mentioned or linked in 10 signals
Patch or workaround mentioned in 44 signals
Technical details provided in 61 signals
Disclosure: 24 classified signals
Peaked 20d ago at 22 mentions (2026-06-18); latest day: 1
77 total mentions across 22 days

Affected systems

Vendors

Products

nginx_gateway_fabricnginx_ingress_controllernginx_instance_managernginx_open_source

2 versions affected across 4 products

Deep dive

Activity timeline77 mentions / 22d

Signal classification6 categories

Patch

3647.4%

Disclosure

2431.6%

PoC

911.8%

Active Exploitation

33.9%

General

33.9%

Exploit

11.3%

Referenced assets59 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	2	Disclosure1Patch1
2026-06-18	22	Active Exploitation2Disclosure4General3Patch13
2026-06-19	20	Active Exploitation1Disclosure4Patch13PoC2
2026-06-20	2	Disclosure1Patch1
2026-06-21	3	Disclosure2Patch1
2026-06-22	3	Disclosure1Patch2
2026-06-23	1	Disclosure1
2026-06-24	1	Disclosure1
2026-06-26	3	Disclosure2Patch1
2026-06-27	1	Exploit1
2026-07-02	1	Disclosure1
2026-07-03	1	Patch1
2026-07-06	1	Disclosure1
2026-07-12	4	Disclosure1Patch3
2026-07-14	2	Disclosure2
2026-07-25	2	PoC2
2026-07-28	1	Disclosure1
2026-07-30	3	PoC3
2026-07-31	1	Disclosure1
2026-10-27	1	PoC1
2026-10-28	1	PoC1

Full discourse20 posts

Nebula Security@nebusecurity136d
Disclosure
Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.
Post summary
A new RCE (CVE-2026-42530) in Nginx has been disclosed, with a patch already released and an upcoming technical writeup detailing an ASLR bypass.
121665813430105.6K
6.7K followersView on X
Clandestine@akaclandestine136d
Disclosure
CVE-2026-42530 NGINX RCE https://t.co/iLIyZjJfRs
Post summary
The tweet announces a newly identified CVE-2026-42530 that grants remote code execution in NGINX, linking to additional details.
12103178943857.9K
63.3K followersView on X
Zhenpeng (Leo) Lin@Markak_100d
PoC
Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently by multiple groups. Our team at @depthfirstlabs caught it using our internal systems, right alongside CVE-2026-42530, a separate issue in NGINX’s HTTP/3 QPACK implementation.
Post summary
The post announces the open‑source release of an RCE proof‑of‑concept for CVE‑2026‑42533, detailing info‑leak and OOB heap write primitives that bypass ASLR, but makes no claim of active exploitation or a patch.
789337722730.5K
3.6K followersView on X
dbugs@ptdbugs4d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-42530 PT ID: PT-2026-50439 Read on dbugs: https://dbu.gs/vulnerability/PT-2026-50439 Vendor: F5 Product: NGINX Open Source Description: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Link: https://github.com/udyz/cve-2026-42530
Post summary
The text announces the discovery of a PoC/exploit for CVE-2026-42530 in F5 NGINX Open Source's HTTP/3 QUIC module, linking to a GitHub repository and providing technical details about a Use-after-Free vulnerability.
040416711019.5K
4.0K followersView on X
The Hacker News@TheHackersNews136d
Patch
🚨 Two critical NGINX flaws can lead to remote code execution. F5 has patched: • CVE-2026-42530 (HTTP/3 use-after-free) • CVE-2026-42055 (HTTP/2 heap buffer overflow) Both require specific configurations and ASLR bypass conditions. Details here → https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html
Post summary
F5 has released patches for two critical NGINX vulnerabilities that could lead to remote code execution, with the notice providing specific technical details but no evidence of active exploitation or proof‑of‑concept.
45961776254.4K
2.2M followersView on X
moton@moton94d
PoC
CVE-2026-42530: NGINX HTTP/3 RCE PoC Disclosed - https://securityonline.info/nginx-http3-rce-cve-2026-42530/
Post summary
A proof‑of‑concept for CVE‑2026‑42530, an NGINX HTTP/3 remote code execution flaw, has been made public, but no details on active exploitation or patches are provided.
04001576610.5K
758 followersView on X
The Hacker News@TheHackersNews132d
Patch
Update: the critical NGINX flaws now have a clearer technical path. CVE-2026-42530 comes down to an HTTP/3 lifetime mismatch that can leave a freed stream pointer treated as valid. CVE-2026-42055 lets oversized HPACK data write past its buffer, causing unauthenticated worker crashes. Patch or apply mitigations. Read: https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html
Post summary
The post outlines technical details of two critical NGINX CVEs and urges applying patches or mitigations.
13311122530.4K
2.2M followersView on X
SOCRadar®@socradar135d
Patch
NGINX admins, your weekend might be starting early (and not in a good way). 🚨 F5 just dropped out-of-band fixes for two nasty NGINX flaws that can trigger remote DoS and potentially lead to RCE. 🔹 CVE-2026-42530 (HTTP/3 QUIC) 🔹 CVE-2026-42055 (HTTP/2 & gRPC proxying) Both can force worker restarts on exposed systems. Patch now to mitigate the risk and keep your servers humming. 🛠️ https://hubs.la/Q04l_j-00 #F5 #NGINX #CyberSecurity #VulnerabilityManagement #InfoSec
Post summary
F5 released out‑of‑band patches for two NGINX CVEs that enable remote DoS and possible RCE; administrators are urged to update immediately.
36023133.2K
6.6K followersView on X
Zhenpeng (Leo) Lin@Markak_100d
PoC
RCE implementation: https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main CVE-2026-42533 security advisory: https://my.f5.com/manage/s/article/K000162097 CVE-2026-42530 security advisory: https://my.f5.com/manage/s/article/K000161616
Post summary
The post provides a GitHub link to a proof‑of‑concept exploit for an RCE and references F5 advisories for CVE‑2026‑42533 and CVE‑2026‑42530 without indicating active exploitation or patches.
03016172.0K
3.6K followersView on X
portbuster@portbuster13375d
PoC
i'll just drop this here, write stage only, no leak stage CVE-2026-42530 https://gist.github.com/portbuster1337/ab7cf6d5ce1f20ab3944895f51574eb1
Post summary
The post references CVE-2026-42530 and links to a GitHub gist as the PoC, indicating proof-of-concept sharing, while no active exploitation, patch, technical details, or debunking are mentioned.
01012132.1K
436 followersView on X
dbugs@ptdbugs128d
Disclosure
⚡️Analysis of the CVE-2026-42530 vulnerability in NGINX HTTP/3 PT ID: PT-2026-50439 This article examines the high-severity vulnerability CVE-2026-42530 discovered in the HTTP/3 (QUIC) implementation of the NGINX server, specifically within the QPACK handling logic. The researcher identified a use-after-free vulnerability that can be triggered by a remote attacker immediately after completing the QUIC handshake. In its simplest form, exploitation causes a worker process crash; however, with more precise heap grooming, the vulnerability can be leveraged to achieve arbitrary code execution. The root cause lies in a lifetime mismatch between objects: a pointer at the HTTP/3 session level continues to reference memory associated with a short-lived unidirectional stream. Once the stream is closed, the memory is freed, but the pointer is still considered valid by the program and continues to be used, leading to a use-after-free condition. 📎 Article : https://cystack.net/vi/research/cve-2026-42530-nginx-en#exploitation #dbugs_attacks
Post summary
The article discloses technical details of CVE-2026-42530, a high‑severity use‑after‑free in NGINX’s HTTP/3 implementation, outlining its root cause and potential for arbitrary code execution.
020163848
3.0K followersView on X
Nicolas Krassas@Dinosn135d
Disclosure
Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530 https://cystack.net/vi/research/cve-2026-42530-nginx-en
Post summary
The notice announces a new use‑after‑free vulnerability in nginx HTTP/3's QPACK encoder (CVE‑2026‑42530) and provides a link for further details, but offers no PoC, exploit, or mitigation information.
0101362.2K
159.6K followersView on X
Trail of Bits@trailofbits93d
Disclosure
Remote and unauthenticated, it can crash nginx and potentially run code, all through HTTP/3. Engineer Evan Hellman found it with Codex after roughly 14 hours of automated analysis. CVE-2026-42530 in the dashboard: https://trailofbits.com/patch-the-planet/dashboard/
Post summary
CVE‑2026‑42530 is a remote, unauthenticated nginx vulnerability that can crash the server and potentially allow code execution through HTTP/3, discovered after automated analysis by Evan Hellman using Codex.
0321041.6K
39.6K followersView on X
Frank@jedisct1137d
Patch
nginx 1.30.3 and 1.31.2 released to fix CVE-2026-42055, CVE-2026-48142 and CVE-2026-42530 https://nginx.org
Post summary
The post announces nginx 1.30.3 and 1.31.2 releases that include fixes for three CVEs.
011101839
17.5K followersView on X
The CyberSec Guru@thecybersecguru135d
PoC
@akaclandestine Technical details behing Nginx;s CVE-2026-42530 & CVE-2026-42055..with PoCs and more https://thecybersecguru.com/news/nginx-cve-2026-42530-cve-2026-42055-rce/
Post summary
The tweet announces the existence of Proof‑of‑Concepts for Nginx CVE‑2026‑42530 and CVE‑2026‑42055, but offers no evidence of active exploitation, patches, or a debunking claim.
010461.1K
1.2K followersView on X
GovCERT.CZ@GOVCERT_CZ135d
Patch
🚨 Upozorňujeme na závažné zranitelnosti v NGINX, CVE-2026-42530 a CVE-2026-42055. CVE-2026-42530: jedná se o chybu typu use-after-free v modulu ngx_http_v3_module, která může být zneužita vzdáleným neautentizovaným útočníkem při použití HTTP/3 QUIC a speciálně vytvořené HTTP/3 relace k opětovnému otevření QPACK encoder streamu, což umožňuje spuštění libovolného kódu na systémech s deaktivovaným ASLR nebo při jeho obejití. CVE-2026-42055: jedná se o chybu typu heap-based buffer overflow v modulech ngx_http_proxy_v2_module a ngx_http_grpc_module, kterou lze zneužít při proxy provozu HTTP/2 za specifických konfiguračních podmínek (proxy_http_version nastaveno na 2 nebo grpc_pass, ignore_invalid_headers vypnuto a large_client_header_buffers větší než 2 MB), což rovněž umožňuje vzdálené spuštění kódu bez autentizace při neaktivním nebo obejitelném ASLR. Zranitelnosti ovlivňují více verzí NGINX Open Source, NGINX Plus, NGINX Ingress Controller, Gateway Fabric a dalších komponent, přičemž opravy jsou dostupné například ve verzích NGINX Open Source 1.31.2 a 1.30.3, NGINX Plus 37.0.2.1 nebo Gateway Fabric 2.6.4. 📌Doporučujeme aktualizovat na uvedené opravené verze a současně aplikovat mitigace: deaktivovat HTTP/3 pro CVE-2026-42530 a upravit konfiguraci (odstranit ignore_invalid_headers off nebo snížit large_client_header_buffers pod 2 MB) pro CVE-2026-42055.
Post summary
The post discloses two critical NGINX vulnerabilities, provides detailed technical information, and recommends specific patch versions and configuration mitigations to address them.
03042598
4.3K followersView on X
/r/netsec@_r_netsec135d
Disclosure
Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530 https://cystack.net/vi/research/cve-2026-42530-nginx-en
Post summary
The message announces the discovery of a new use‑after‑free vulnerability in nginx’s QPACK encoder for HTTP/3 (CVE‑2026‑42530), with a link to a research article but no PoC, exploit code, or patch information.
040401.2K
33.6K followersView on X
ProjetoLabo@ProjetoLabo136d
Active Exploitation
Mais uma do NGIX, fica ligado desenvolvedor de SAAS em VPS. Duas brechas graves no NGINX, ambas nota 9.2, e a F5 lançou correção de emergência. O Nginx Rift já está sendo explorado desde maio. A CVE-2026-42530 é um erro de gerenciamento de memória no HTTP/3 que atinge as versões 1.31.0 e 1.31.1. A CVE-2026-42055 também corrompe a memória pelos módulos proxy. Nenhuma das duas exige autenticação e, sem a proteção de segurança do sistema (ASLR), viram execução remota de código. Mais duas falhas altas no Gateway Fabric, que expõem dados internos e deixam alterar configurações do servidor, além de duas médias. A F5 não esperou o ciclo normal de correção, a atualização saiu antes do previsto. NGINX roda em quase um terço dos servidores web do mundo. Seu servidor já está na 1.31.2 ou 1.30.3?
Post summary
The text advertises that CVE-2026-42530 and CVE-2026-42055 are actively exploited in NGINX, with emergency patches already released and explicit technical details indicating remote code execution via memory corruption.
0102198
190 followersView on X
The CyberSec Guru@thecybersecguru135d
Patch
Breaking: Two critical NGINX bugs just dropped. CVE-2026-42530: HTTP/3 QPACK UAF CVE-2026-42055: HTTP/2/gRPC heap overflow Remote. Unauthenticated. CVSS 9.2. Patches are live. Patch em before the exploit race starts: https://thecybersecguru.com/news/nginx-cve-2026-42530-cve-2026-42055-rce/
Post summary
The post announces two critical NGINX bugs, details their nature and severity, and stresses that patches are already available and should be applied promptly—no active exploitation or PoC information is provided.
01011110
970 followersView on X
Daily CyberSecurity@Daily_CyberSec94d
PoC
A public PoC now details CVE-2026-42530, an NGINX HTTP/3 RCE from a QPACK use-after-free. Upgrade to NGINX 1.31.2 to close the flaw now. #NGINX #HTTP3 #CVE202642530 #RCE #UseAfterFree #QUIC #QPACK #PoC #Cybersecurity http://securityonline.info/nginx-http3-rce-cve-2026-42530/
Post summary
A public PoC demonstrates an RCE in NGINX HTTP/3 via a QPACK use‑after‑free; patching to version 1.31.2 resolves the issue.
01001478
12.6K followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	f5	nginx_gateway_fabric	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_ingress_controller	4.0.0	-	-
App	f5	nginx_ingress_controller	4.0.1	-	-
App	f5	nginx_instance_manager	-	-	-
App	f5	nginx_open_source	-	-	-

Explore more

Back to dashboard f5 CVEs nginx_gateway_fabric vulnerabilities

What researchers are saying

CVE-2026-42530

Nebula Security[verified]@nebusecurityDisclosure

A new RCE (CVE-2026-42530) in Nginx has been disclosed, with a patch already released and an upcoming technical writeup detailing an ASLR bypass.

Clandestine[verified]@akaclandestineDisclosure

The tweet announces a newly identified CVE-2026-42530 that grants remote code execution in NGINX, linking to additional details.

Zhenpeng (Leo) Lin[verified]@Markak_PoC

The post announces the open‑source release of an RCE proof‑of‑concept for CVE‑2026‑42533, detailing info‑leak and OOB heap write primitives that bypass ASLR, but makes no claim of active exploitation or a patch.

dbugs[verified]@ptdbugsPoC

The text announces the discovery of a PoC/exploit for CVE-2026-42530 in F5 NGINX Open Source's HTTP/3 QUIC module, linking to a GitHub repository and providing technical details about a Use-after-Free vulnerability.

SOCRadar®[verified]@socradarPatch

F5 released out‑of‑band patches for two NGINX CVEs that enable remote DoS and possible RCE; administrators are urged to update immediately.

Zhenpeng (Leo) Lin[verified]@Markak_PoC

The post provides a GitHub link to a proof‑of‑concept exploit for an RCE and references F5 advisories for CVE‑2026‑42533 and CVE‑2026‑42530 without indicating active exploitation or patches.

dbugs[verified]@ptdbugsDisclosure

The article discloses technical details of CVE-2026-42530, a high‑severity use‑after‑free in NGINX’s HTTP/3 implementation, outlining its root cause and potential for arbitrary code execution.

Nicolas Krassas[verified]@DinosnDisclosure

The notice announces a new use‑after‑free vulnerability in nginx HTTP/3's QPACK encoder (CVE‑2026‑42530) and provides a link for further details, but offers no PoC, exploit, or mitigation information.