NGINX HTTP/3 QPACK use‑after‑free (CVE‑2026‑42530) lets unauthenticated attackers crash or hijack workers
A newly disclosed use‑after‑free in nginx’s ngx_http_v3_module lets a remote, unauthenticated client reopen a QPACK encoder stream, corrupting freed memory. Exploitation can cause worker crashes and, if memory layout is favorable, remote code execution. The flaw affects any nginx build with HTTP/3 enabled and is scored 9.2 CVSS.