How severe is CVE-2026-42530?

CVE-2026-42530 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-42530 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-42530?

CVE-2026-42530 primarily affects F5 Nginx Gateway Fabric. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-42530?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-42530 have an EU (EUVD) identifier?

Yes. CVE-2026-42530 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-37717.

When was CVE-2026-42530 published?

CVE-2026-42530 was published on 2026-06-17 and last updated on 2026-07-02.

CVE-2026-42530

CVE-2026-42530 is a high-severity vulnerability in F5 Nginx Gateway Fabric with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-416.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v4: 9.2
EPSS exploit prediction: 3% (87th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-37717
Weakness: CWE-416
Affected product: F5 Nginx Gateway Fabric
Published: 2026-06-17
Last modified: 2026-07-02

Description

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Frequently asked questions

What is CVE-2026-42530?: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
How severe is CVE-2026-42530?: CVE-2026-42530 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-42530 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-42530?: CVE-2026-42530 primarily affects F5 Nginx Gateway Fabric. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-42530?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-42530 have an EU (EUVD) identifier?: Yes. CVE-2026-42530 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-37717.
When was CVE-2026-42530 published?: CVE-2026-42530 was published on 2026-06-17 and last updated on 2026-07-02.

References

Affected products (6)

cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*

More vulnerabilities in F5 Nginx Gateway Fabric

CVE-2026-50107 — High (CVSS 8.1): When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection…
CVE-2026-42055 — High (CVSS 8.1): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and…
CVE-2026-11311 — High (CVSS 8.1): When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the…
CVE-2026-42945 — High (CVSS 8.1): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists…
CVE-2026-32682 — Medium (CVSS 6.5): When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create…
CVE-2026-42946 — Medium (CVSS 6.5): A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive…

All CVEs affecting F5 Nginx Gateway Fabric →

Other CWE-416 (Use After Free) vulnerabilities

CVE-2026-13782 — Critical (CVSS 10.0): Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the…
CVE-2026-4725 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149…
CVE-2026-4688 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox…
CVE-2025-24085 — Critical (CVSS 10.0): A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3,…
CVE-2024-43102 — Critical (CVSS 10.0): Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of…
CVE-2021-32495 — Critical (CVSS 10.0): Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory…

Browse all CWE-416 (Use After Free) vulnerabilities →