Two Critical NGINX Open Source Bugs Open the Door to Remote Code Execution

Key points

• F5 has patched two critical vulnerabilities in NGINX Open Source, both with CVSS v4 scores above 9.
• CVE-2026-42530 is a use-after-free in the HTTP/3 module, exploitable by a remote unauthenticated attacker.
• The attack requires NGINX to be compiled with HTTP/3 support and configured to accept QUIC traffic.
• HTTP/3 in NGINX is opt-in, so operators who never enabled it can patch on a normal schedule.
• F5 has not confirmed active exploitation as of publication.

What did F5 just patch?

F5 has shipped fixes for two critical vulnerabilities in NGINX Open Source, either of which is enough to execute code on an affected host. Both carry CVSS v4 scores above 9. We covered a separate NGINX-affecting flaw on 3 June 2026 in our HTTP/2 Bomb story; this is a different code path and a harder class of bug.

The headline flaw is CVE-2026-42530, a use-after-free in ngx_http_v3_module, the HTTP/3 implementation built on top of QUIC. CVSS v4: 9.2. A remote, unauthenticated attacker can trigger it against any NGINX build compiled with HTTP/3 support and configured to accept QUIC traffic. The module is not enabled by default. The second flaw lives in the same area of the codebase and is also rated critical. Check F5's advisory directly for affected branches and fixed build numbers; downstream summaries lag.

Why does this class of bug move so fast?

Use-after-free flaws in network-facing parsers get weaponized quickly. There's no authentication step, no user interaction required. A malformed HTTP/3 frame handled incorrectly by the worker process produces memory corruption in something that's often reachable from the open internet. Public proof-of-concept code for comparable HTTP/3 parser bugs has historically appeared within days of disclosure.

Should you worry?

That depends entirely on your configuration. HTTP/3 in NGINX Open Source is still opt-in, so operators terminating TLS 1.3 over TCP without touching any QUIC listener directives can patch on a normal cadence. Anyone who enabled listen ... Quic should treat this as a same-day job.

Before assuming you're not exposed, grep your configs for quic and http3 directives. Container images and inherited templates sometimes enable the listener without the operator knowing it. If patching isn't immediately possible, blocking inbound QUIC-destined traffic at the edge removes the HTTP/3 path while leaving HTTP/2 over TCP intact; clients will renegotiate down.

NGINX Plus and commercial derivatives shipped inside appliances have their own patch timelines. Don't rely on the upstream changelog for those.

What to watch next

F5 hasn't indicated active exploitation as of publication, but that status is rarely durable for unauthenticated pre-auth RCE in widely deployed web infrastructure. Patch first, then audit your QUIC exposure.