BLOG
At a glance
- Nginx 1.31.0–1.31.1 has a use-after-free vulnerability in HTTP/3 handling.
- The vulnerability is CVE-2026-42530; the advisory rates its severity as major.
- Upgrade to Nginx 1.31.2 or later, which is not affected.
Nginx 1.31.0–1.31.1 affected by HTTP/3 use-after-free: upgrade to 1.31.2 or later
Nginx 1.31.0–1.31.1 is affected by an HTTP/3 use-after-free vulnerability, CVE-2026-42530, rated major in the advisory. Check the running version and upgrade to Nginx 1.31.2 or later.
In this article
Nginx Security published an advisory about CVE-2026-42530 in Nginx 1.31.0–1.31.1. Administrators can check the running version and upgrade to Nginx 1.31.2 or later according to the Nginx Security advisory.
Overview and technical details
The use-after-free vulnerability is in HTTP/3 handling and may affect Nginx versions within the affected range. The advisory rates the severity as major; this is not a CVSS score.
| Field | Details |
|---|---|
| Product | Nginx |
| Vulnerability ID | CVE-2026-42530 |
| Severity | Major |
| Source | Nginx Security |
Affected systems
| Product | Affected versions | Unaffected versions |
|---|---|---|
| Nginx | 1.31.0–1.31.1 | 1.31.2 or later |
Mechanism and impact
The cause is a use-after-free flaw in HTTP/3. The supplied information says the flaw may affect Nginx within the vulnerable versions, but does not confirm a more specific impact type.
System checks
Check the running Nginx version with:
nginx -vYou can also check version information with:
nginx -V
If the version is 1.31.0–1.31.1, upgrade is needed. Nginx 1.31.2 or later is unaffected according to the advisory.
Remediation and mitigation
Upgrade Nginx to version 1.31.2 or later, which is confirmed as unaffected.
References
Related articles
Nginx discloses CVE-2026-56434 in ngx_http_ssi_module: upgrade affected versions
Nginx disclosed CVE-2026-56434, a use-after-free vulnerability in ngx_http_ssi_module affecting versions 0.8.11–1.31.2. Check the installed version with nginx -V and upgrade to 1.30.4+ or 1.31.3+, which are confirmed unaffected branches.
Nginx: memory disclosure vulnerability CVE-2026-60005 when using the slice module
Nginx has a memory disclosure vulnerability, CVE-2026-60005, when using ngx_http_slice_module. Versions 1.15.8–1.31.2 are affected; check the version and configuration, then upgrade to 1.31.3 or later, or 1.30.4 or later.
