The vulnerability CVE-2026-42530 in NGINX Open Source (version 1.31.0) involves a use-after-free condition in the ngx_http_v3_module when HTTP/3 QUIC is enabled. A remote unauthenticated attacker can exploit this by sending a specially crafted HTTP/3 session that reopens a QPACK encoder stream, leading to a use-after-free in the worker process. This can cause the worker process to restart and, in environments without ASLR or where ASLR is bypassed, may lead to remote code execution. The vulnerability has a CVSS 3.1 base score of 8.1 (high severity) with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Red Hat has issued an advisory referencing this CVE but does not explicitly confirm a patch or remediation level for this vulnerability in their updates.

Successful exploitation can cause a denial of service by restarting the NGINX worker process. Additionally, on systems without ASLR or where ASLR can be bypassed, remote code execution is possible, potentially allowing an attacker to execute arbitrary code with the privileges of the NGINX worker process. The vulnerability is exploitable remotely without authentication but requires conditions beyond the attacker's control related to ASLR.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory references this CVE but does not explicitly state that a patch or official fix is available. Users should monitor the vendor advisory and apply updates once a fix is released. Until then, consider disabling the HTTP/3 QUIC module if feasible to mitigate exposure to this vulnerability.