Skip to content
Sign in
CVE-2026-425309.2CriticalCWE-416

F5 NGINX Open Source vulnerability

F5 · NGINX Open Source

Not in CISA KEVVendor fix available
6.5%probability of exploitation in the next 30 days
93rd percentile
050100

Higher than 93% of scored CVEs

9.2CriticalCVSS 3.1
LowCrit.

DescriptionNVD

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Coverage5 articles · 4 outlets

One row per outlet, in order of first report. First in our coverage: SecurityWeek, 18 Jun.

Full timeline
Quiet for 14 weekslast report 30 Jul5 articles4 outlets
18 Jun · SecurityWeek first28 Aug21 SepNow
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.
All coveragerunning total5SecurityWeek1Security Af…1SecurityOnl…2SOCRadar119 Jun4 Aug19 SepNow
  • First report
  • Article
  • Running total
Show as table
5 articles about CVE-2026-42530 from 4 outlets
Published (UTC)OutletHeadline
18 Jun 09:54SecurityWeekF5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055
18 Jun 15:11Security AffairsF5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution
19 Jun 03:31SecurityOnlineF5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)
19 Jun 14:02SOCRadarF5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws
30 Jul 15:07SecurityOnlineCVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution
  1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution
    SecurityOnline
  2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws
    SOCRadar
  3. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)
    SecurityOnline
  4. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution
    Security Affairs
  5. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055
    SecurityWeek · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in