Vulnerability of the ngx_http_v3_module in NGINX HTTP servers; NGINX Open Source platform for application monitoring and management; NGINX Ingress Controller, NGINX Gateway Fabric server controller; NGINX Instance Manager automation platform. These tools allow attackers to circumvent security restrictions, execute arbitrary code, or cause service failures.

🗓️ 22 Jun 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Nginx use-after-free in modules and controllers enables remote code execution, security bypass, or crashes.

Reporter	Title	Published	Views	Family All 47
GithubExploit	Exploit for CVE-2026-42530	19 Jun 202601:04	–	githubexploit
GithubExploit	Exploit for CVE-2026-42530	19 Jun 202619:23	–	githubexploit
GithubExploit	Exploit for Command Injection in Tenda Ac8_Firmware	25 Jun 202612:11	–	githubexploit
FreeBSD	nginx -- multiple vulnerabilities	17 Jun 202600:00	–	freebsd
Circl	CVE-2026-42530	17 Jun 202617:58	–	circl
CVE	CVE-2026-42530	17 Jun 202614:04	–	cve
Cvelist	CVE-2026-42530 NGINX Open-Source ngx_http_v3_module vulnerability	17 Jun 202614:04	–	cvelist
Debian CVE	CVE-2026-42530	17 Jun 202614:04	–	debiancve
EUVD	EUVD-2026-37717	17 Jun 202614:04	–	euvd
F5 Networks	K000161614: Out-of-band Security Notification (June 17, 2026)	17 Jun 202613:53	–	f5

Vulners

Node

nginx nginx_gateway_fabricRange1.3.0–1.6.2

OR

nginx nginx_ingress_controllerRange4.0.0–4.0.1

OR

nginx nginx_ingress_controllerRange3.5.0–3.7.2

OR

nginx nginx_instance_managerRange2.17.0–2.22.0

OR

nginx nginx_open_sourceRange1.31.0–1.31.2

OR

nginx nginx_gateway_fabricRange2.0.0–2.6.4

OR

nginx nginx_ingress_controllerRange5.0.0–5.5.1

Source	Link
github	www.github.com/HORKimhab/CVE-2026-42530
my	www.my.f5.com/manage/s/article/K000161616
my	www.my.f5.com/manage/s/article/K000161614
web	www.web.nvd.nist.gov/view/vuln/detail

22 Jun 2026 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 27.6

CVSS 38.1

EPSS0.03299

Nginx module vulnerability use after free remote code execution security bypass service crashes