🛡️ CVE-2026-42530 - NGINX HTTP/3 (QUIC) Use-After-Free Vulnerability

High-Severity Use-After-Free in NGINX HTTP/3 (QUIC)

---

⚠️ QPACK Encoder Stream Vulnerability

🔍 Overview

CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngx_http_v3_module.

A remote unauthenticated attacker can trigger it by reopening a closed QPACK encoder stream over HTTP/3, causing worker process crashes (DoS) and potential Remote Code Execution in some configurations.

🚨 Severity

Impact: DoS + Possible RCE (ASLR bypass possible)

📌 Affected Versions

• NGINX Open Source — 1.31.0, 1.31.1
• Certain NGINX Plus releases
• Any server with http3 / QUIC enabled

Fixed in: 1.31.2 (released June 17, 2026)

🛠️ Safe Checker (CVE-2026-42530-safe-check.py)

python3 CVE-2026-42530-safe-check.py <target> [-p PORT] [-t TIMEOUT]

Features:

• ✅ Non-destructive (safe)
• ✅ Real HTTP/3 + QUIC connection
• ✅ Version fingerprinting
• ✅ Beautiful colored output

🔍 Best Shodan Dorks

"nginx/1.31.0" OR "nginx/1.31.1" quic OR http3
nginx "http/3" OR quic port:443
"alt-svc: h3" nginx
port:443 nginx quic

🛡️ Mitigation

1. Upgrade immediately to NGINX 1.31.2+
2. Disable HTTP/3 (recommended workaround):
   root@kitploit:~

   listen 443 ssl;        # instead of listen 443 http3;
   

3. Set server_tokens off;

📚 References

• Official F5 Advisory: K000161616
• CVE Record: CVE-2026-42530