Provenance Record

Clear, well-structured News piece (630 words, within the 400-1200 News range). Logical sections: Overview, What We Know, Mitigations, What We Don't Know, Analysis. Technical depth appropriate for a CVE advisory story; module names, version ranges, and config preconditions are all stated precisely.

Read all 6 gzipped snapshots from disk and verified every cited claim. source-0 (NVD CVE-2026-42530): confirms CVSS v4 9.2 CRITICAL with exact vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, CVSS v3.1 8.1 HIGH, the QPACK/use-after-free quote verbatim, ngx_http_v3_module, published 06/17/2026, and the ASLR-disabled code-execution condition. source-1 (NVD CVE-2026-42055): confirms CVSS-B 9.2, heap-based buffer overflow, the 'NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules' quote verbatim, and the ignore_invalid_headers off / large_client_header_buffers >2MB preconditions. source-2 (nginx.org): confirms HTTP/3 use-after-free rated 'major', vulnerable 1.31.0-1.31.1 fixed 1.31.2; CVE-2026-42055 vulnerable 1.13.10-1.31.1 fixed 1.31.2/1.30.3. source-3 (BleepingComputer): confirms out-of-band framing, 'didn't flag any of these security issues as exploited in attacks', Gateway Fabric CVE-2026-11311 and CVE-2026-50107 (authenticated config-injection), the mitigation steps (disable HTTP/3 via removing quic, remove ignore_invalid_headers off, reduce large_client_header_buffers below 2MB), and the 'often been exploited by both cybercrime and nation-state threat groups' quote verbatim. source-4 (Security Affairs): confirms 'disabled or when the attacker can bypass ASLR', 'exploitation requires non-default configuration to be present', and 'there is no news of attacks in the wild exploiting one of the vulnerabilities' verbatim. source-5 (Tenable): confirms CVSS v4 Base Score 9.2 and the v4 vector string.

Every CVE ID, module name, version range, CVSS v4/v3.1 score, vector string, and direct quote maps exactly to a cited primary or secondary source. No hallucinations or misattributions detected. The June 18 release date is consistent with BleepingComputer's dateline and the out-of-band framing; the NVD published date (June 17) is separately and correctly attributed. Note: nginx.org rates CVE-2026-42055 as 'medium' while NVD scores it CVSS 9.2 — the article correctly attributes the 9.2 to NVD and only applies 'major' to the HTTP/3 bug (CVE-2026-42530), which nginx.org does rate 'major', so there is no conflation.

High-quality, accurate, fully-sourced submission. The automated script returned APPROVE_WITH_CORRECTIONS solely due to an allowlist gap (nginx.org, securityaffairs.com), which is a configuration matter, not a factual defect — nginx.org is the authoritative vendor advisory and Security Affairs claims were verified verbatim. There is no factual error to record in a corrections note, so a corrections record would be empty/dishonest. Overriding to APPROVE.