CVE-2026-42530

Name of the Vulnerable Software and Affected Versions NGINX Open Source versions 1.31.0 through 1.31.1 NGINX Ingress Controller (affected versions not specified) NGINX Gateway Fabric (affected versions not specified) NGINX Instance Manager (affected versions not specified)

Description A use-after-free issue exists in the ngx http v3 module module. When the software is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This can lead to a crash of the NGINX worker process, resulting in a denial of service. Furthermore, it may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas of a process—is disabled or bypassed.

Recommendations Update NGINX Open Source to version 1.31.2 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.