
Scanner PoC for CVE-2026-42530 -- nginx 1.31.0-1.31.1 HTTP/3 QPACK encoder stream Use-After-Free (CVSS 9.2)
Scanner for CVE-2026-42530, a use-after-free in nginx's HTTP/3 module.
Affected: nginx 1.31.0, 1.31.1
Fixed: nginx 1.31.2
pip install aioquic
python3 scanner_CVE-2026-42530.py <host> [port]
python3 scanner_CVE-2026-42530.py --file hosts.txt
Opens two QPACK encoder streams on the same connection. Patched versions reject the second one with 0x103. Vulnerable versions accept it, write into freed memory, and return 0x201.
Only use on systems you own or have permission to test.
Valton Tahiri (@v4ltonn)