Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution

Part of the CVE-2026-42530 story · since 18 Jun

Quiet for 13 weekslast report 30 Jul5 articles4 outlets
18 Jun · SecurityWeek first25 Aug17 Sep10 OctNowThis article5th of 5
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution. This article, 5th of 5.

The content discusses a critical vulnerability identified as CVE-2026-42530 affecting the F5 NGINX Open Source HTTP/3 module, rated 9.2 on the CVSS scale. This vulnerability, which allows remote code execution via a use-after-free flaw in QPACK header compression, requires no user authentication. Although there has been no confirmed exploitation yet, the risk includes denial-of-service attacks and potential code execution in vulnerable configurations. Affected versions are 1.31.0 and 1.31.1, with a fix available in 1.31.2. Users are advised to upgrade immediately or disable HTTP/3 to mitigate the risk.

How the story developed

All 5 articles
Quiet for 13 weekslast report 30 Jul5 articles4 outlets

5 articles from 4 outlets since 18 Jun. Quiet since 30 Jul. This was the 5th report, 42 days after the first.

Now18 Jun19202130 Jul1 AugFirst reportSecurityWeek · 18 Jun, 09:54This article5th of 5 · day 42
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution. This article, 5th of 5.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 18 JunDay 02
    1. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-4205509:54 · SecurityWeek · First report
    2. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution15:11 · Security Affairs
  2. Fri 19 JunDay 12
    1. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)03:31 · SecurityOnline
    2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws14:02 · SOCRadar

  3. Quiet for 6 weeks

    Thu 30 JulDay 421
    1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution15:07 · SecurityOnline · Picked up again · This article, 5th of 5

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in