F5 Ships Out-of-Band NGINX Patches for Two Critical Flaws, Including a 9.2 HTTP/3 Use-After-Free Reachable by Unauthenticated Attackers
F5 patched CVE-2026-42530, a CVSS 9.2 use-after-free in NGINX's HTTP/3 module, alongside a second 9.2 buffer overflow. Neither is known to be exploited.
Overview
F5 has issued out-of-band patches for two critical vulnerabilities in NGINX, the most serious of which is a use-after-free in the web server’s HTTP/3 implementation that a remote, unauthenticated attacker can reach across the network. The flaw, tracked as CVE-2026-42530, carries a CVSS v4 base score of 9.2 and was published on June 17, 2026, according to its National Vulnerability Database entry. F5 released the fixes out-of-band on June 18, and as reported by BleepingComputer, the company did not flag any of the issues as exploited in attacks.
What We Know
CVE-2026-42530 lives in the ngx_http_v3_module. According to the NVD, “When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream.” That sequence triggers a use-after-free in the worker process, which at minimum forces a restart. Code execution becomes possible only when Address Space Layout Randomization is, in the words of Security Affairs, “disabled or when the attacker can bypass ASLR.”
The official nginx security advisories page rates the HTTP/3 use-after-free as “major” and lists NGINX Open Source versions 1.31.0 through 1.31.1 as vulnerable, with the fix landing in 1.31.2. The CVSS v4 score of 9.2 is corroborated by Tenable, which records the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The same vulnerability maps to a CVSS v3.1 score of 8.1, per the NVD.
The second critical flaw, CVE-2026-42055, is a heap-based buffer overflow. The NVD states that “NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules,” reachable when HTTP/2 proxying is configured, header validation is disabled, and large header buffers exceed 2 megabytes. It also carries a CVSS v4 score of 9.2. Its affected range is far wider than the HTTP/3 bug: NGINX Open Source releases from 1.13.10 through 1.31.1 are listed as vulnerable, with fixes in 1.31.2 and 1.30.3, according to nginx.org.
Both flaws depend on configurations that are not enabled by default. Security Affairs notes that for the buffer overflow, “Exploitation requires non-default configuration to be present,” and the HTTP/3 issue only applies when the QUIC module is in use. F5 also addressed two high-severity vulnerabilities in NGINX Gateway Fabric, CVE-2026-11311 and CVE-2026-50107, which BleepingComputer reports could let authenticated attackers inject arbitrary NGINX configuration directives.
Mitigations
Upgrading to NGINX Open Source 1.31.2 closes both critical bugs. For administrators who cannot patch immediately, BleepingComputer reports that the HTTP/3 flaw can be neutralized by disabling HTTP/3 — removing the quic parameter from all listen directives — while the buffer overflow can be sidestepped by removing the ignore_invalid_headers off directive and reducing large_client_header_buffers below 2 megabytes.
What We Don’t Know
Neither advisory reports active exploitation; Security Affairs states plainly that “There is no news of attacks in the wild exploiting one of the vulnerabilities.” It is not yet clear how many internet-facing NGINX instances run the affected 1.31.x branch with HTTP/3 enabled, which determines the real-world reach of CVE-2026-42530. The published advisories also do not detail a public proof-of-concept for either flaw.
Analysis
The out-of-band timing is the notable signal here. NGINX security fixes typically ride scheduled releases, so shipping patches off-cycle indicates F5 judged the pair serious enough not to wait — even absent evidence of exploitation. The HTTP/3 bug is the one to watch: it requires no authentication and no unusual preconditions beyond the QUIC module being switched on, and BleepingComputer notes that F5 vulnerabilities “have often been exploited by both cybercrime and nation-state threat groups in recent years.” With NGINX sitting in front of a large share of the web, a reachable use-after-free in its newest protocol stack is the kind of finding that attackers tend to revisit once a patch reveals where to look.