CVE-2026-42530 — Safe-Check Scanner

Non-destructive mass scanner for the NGINX HTTP/3 (QUIC) use-after-free
Inventory which of your hosts are exposed — without ever triggering the bug.

⚠️ Disclaimer

This tool is for authorized security testing only — your own infrastructure, or systems you have explicit written permission to assess. It performs a read-only fingerprint and does not exploit the vulnerability. You are responsible for staying within scope and complying with applicable law and responsible-disclosure principles. The authors accept no liability for misuse.

🔍 About the vulnerability

CVE-2026-42530 is a use-after-free (CWE-416) in NGINX's ngx_http_v3_module. When NGINX is configured to serve HTTP/3, a remote, unauthenticated attacker can reopen a QPACK encoder stream within a crafted HTTP/3 session, causing a worker process to reference freed memory. The immediate impact is a worker crash / restart (denial of service); on hosts where ASLR is disabled or can be bypassed, it may escalate to remote code execution.

Key point: the flaw is only reachable when HTTP/3 (QUIC) is enabled — it is not on by default. Hosts serving only HTTP/1.1 or HTTP/2 over TCP are not affected by this specific vector.

Affected & fixed versions

✨ What this scanner does

It opens a real HTTP/3 connection, sends a single HEAD / request, and reads back the Server header. From that it classifies each target — and crucially, it treats reachable-but-version-hidden hosts as needs manual review rather than a false "clean", because QUIC being reachable is the precondition for the CVE.

• 🛡️ Safe by design — only a benign probe; never reopens a QPACK stream, never sends a crafted/malicious session.
• 📋 Mass scanning — feed it a target list from a file or stdin.
• ⚡ Concurrent — async (asyncio) engine handles hundreds of QUIC handshakes in flight with a single, tunable bound.
• 🎯 Actionable classification — six clear statuses instead of a bare true/false.
• 📦 Report-ready output — colorized console summary plus CSV / JSON for engagement documentation.
• 🚦 CI-friendly — exits non-zero when any host is vulnerable.

Status meanings

📦 Installation

Requires Python 3.11+ (uses asyncio.timeout).

git clone https://github.com/renzi25031469/CVE-2026-42530-scanner.git
cd CVE-2026-42530-scanner
pip install aioquic

Tip: use a virtual environment — python3 -m venv .venv && source .venv/bin/activate.

🚀 Usage

# Single host
python3 cve-2026-42530-scanner.py example.com

# Many hosts from a file, 100 in parallel, save a CSV
python3 cve-2026-42530-scanner.py -f targets.txt -c 100 --csv results.csv

# Pipe targets from stdin and export JSON
cat hosts.txt | python3 cve-2026-42530-scanner.py -f - --json results.json

# Custom port and timeout
python3 cve-2026-42530-scanner.py target.internal -p 8443 -t 5

Target file format

One host per line. Ports, schemes, paths and comments are handled automatically:

# production edge
edge01.example.com
edge02.example.com:8443
https://api.example.com/

# staging
10.0.5.21

Options

Sample output

[*] CVE-2026-42530 safe-check — 4 target(s), concurrency=100, timeout=10s

======================================================================
CVE-2026-42530 SAFE-CHECK RESULTS
======================================================================
[VULNERABLE              ] edge01.example.com:443  (Server: nginx/1.31.1)
      -> Vulnerable NGINX version over HTTP/3. Upgrade to nginx/1.31.2 or later.
[HTTP3_VERSION_HIDDEN    ] api.example.com:443
      -> HTTP/3 reachable but Server header is masked. Verify the NGINX version manually.
[LIKELY_PATCHED          ] edge02.example.com:8443  (Server: nginx/1.31.2)
[NO_HTTP3                ] 10.0.5.21:443
----------------------------------------------------------------------
Summary: VULNERABLE=1 | HTTP3_VERSION_HIDDEN=1 | LIKELY_PATCHED=1 | NO_HTTP3=1

[!] 1 host(s) appear VULNERABLE. Mitigation: upgrade to nginx/1.31.2 or later,
    or remove 'quic' from all 'listen' directives.
======================================================================

🩹 Remediation

1. Patch — upgrade NGINX Open Source to 1.31.2+ (or apply the F5 advisory for NGINX Plus).
2. Temporary mitigation — if you can't patch immediately, disable HTTP/3 by removing the quic parameter from every listen directive and dropping http3 on;, then reload NGINX. This removes the vulnerable code path entirely.
3. Defense in depth — keep ASLR enabled (/proc/sys/kernel/randomize_va_space = 2). Treat this as a hardening layer, not a substitute for patching.

⚙️ A note on concurrency

aioquic is asynchronous, so this scanner uses an asyncio.Semaphore rather than OS threads. For network-I/O-bound work — hundreds of QUIC handshakes waiting on the wire — a single event loop scales further with far less overhead than a thread pool, while giving the same "scan many hosts at once" behavior. Tune the bound with -c.

🙏 Credits

• Original safe-check author: Ashraf Zaryouh — @0xBlackash · original repository
• Adapted & extended by: Renzi — multi-target file/stdin input, bounded async concurrency for mass scanning, corrected HTTP/3 event handling, structured result classification, and CSV/JSON reporting.

Thanks to the researchers credited in the original disclosure for their coordinated reporting.

📄 License

Released under the MIT License. See LICENSE.

_{Built for defenders and authorized red teams. Scan responsibly. 🔐}