Two Critical NGINX Open Source Bugs Open the Door to Remote Code Execution

F5 has shipped patches for two critical vulnerabilities in NGINX Open Source that can be chained or used independently to execute code on affected hosts. Both carry CVSS v4 scores above 9.

The headline bug is CVE-2026-42530, a use-after-free in ngx_http_v3_module — the HTTP/3 implementation that rides on top of QUIC. CVSS v4: 9.2. A remote, unauthenticated attacker can trigger it against any NGINX build compiled with HTTP/3 support and configured to accept QUIC traffic (the module is not enabled by default, which is the one piece of good news here).

The second issue is in the same neighborhood of the codebase and also rated critical. F5's advisory is the authoritative source on affected branches and fixed builds; defenders should pull version strings directly from
rather than trust downstream summaries.

Why this matters operationally.

Use-after-free bugs in network-facing parsers are exactly the class of flaw that gets weaponized fast. The attack surface is whatever IP and port your edge is listening on for QUIC — typically UDP/443. There is no authentication step. There is no user interaction. If the worker process handles a malformed HTTP/3 frame the wrong way, you are looking at memory corruption in a process that, on a lot of deployments, is reachable from the open internet.

The mitigating factor is configuration. HTTP/3 in NGINX OSS is still relatively new and remains opt-in. Plenty of production fleets terminate TLS 1.3 over TCP and never touched the QUIC listener directives. Those operators can patch on a normal cadence. Anyone who flipped on listen ... quic in the last 18 months should treat this as a same-day job.

A few practical notes for triage:

• Grep your configs for quic and http3 directives before assuming you are not exposed. Reverse proxies inherited from templates or container images sometimes enable it without the operator realizing.
• If you cannot patch immediately, dropping inbound UDP/443 at the edge kills the HTTP/3 path while leaving HTTP/2 over TCP intact. Clients will renegotiate down.
• NGINX Plus and the various commercial derivatives (including third-party builds shipped inside appliances) have their own patch timelines. Check with the vendor, not the upstream changelog.

F5 has not, as of publication, indicated active exploitation. That tends to be a short-lived condition for unauthenticated pre-auth RCE in widely deployed web infrastructure. Public PoCs for use-after-free bugs in HTTP/3 parsers have historically appeared within days of disclosure, not weeks.

Patch, then audit your QUIC exposure. In that order.