Nginx < 1.30.3 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115285

Synopsis

Description

According to its Server response header, the installed version of nginx is prior to 1.30.3 or 1.31.x prior to 1.31.2. It is, therefore, affected by the following issues :

- A Use-After-Free in the ngx_http_v3_module module allows a remote unauthenticated attacker to send a specially crafted HTTP/3 session that reopens a QPACK encoder stream, causing a worker process restart or, on systems with ASLR disabled, arbitrary code execution. (CVE-2026-42530)

- A heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules allows a remote unauthenticated attacker to send large headers during upstream request creation when proxy_http_version 2 or grpc_pass is used with ignore_invalid_headers off and large_client_header_buffers configured above 2 megabytes, causing a worker process restart or, on systems with ASLR disabled, arbitrary code execution. (CVE-2026-42055)

- A heap buffer over-read (CWE-125) in the ngx_http_charset_module module allows a remote unauthenticated attacker to cause limited memory disclosure or a worker process restart when content is served or proxied through a location block configured with both source_charset utf-8 and a charset conversion directive. (CVE-2026-48142)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.