Multiple vulnerabilities affecting NGINX

NGINX is an open source web server and reverse proxy, also used as an HTTP load balancer and cache, and widely deployed for website hosting and application delivery. This solution is affected by several vulnerabilities labeled as follows: CVE-2026-42530: This vulnerability is due to use-after-free within the QUIC HTTP/3 module (ngx_http_v3_module). Exploitation of this vulnerability would allow an unauthenticated attacker to restart the worker process and execute arbitrary code remotely. It is classified high with a severity score of 8.1 according to CVSS v3.1. CVE-2026-42055: This vulnerability results from a heap buffer overflow within the ngx_http_proxy_v2_module and ngx_http_grpc_module modules during HTTP/2 traffic relaying. Exploitation of this vulnerability would allow an unauthenticated malicious actor to restart the worker process and execute arbitrary code remotely. It is classified high with a severity score of 8.1 according to CVSS v3.1.

• CVE-2026-42530: NGINX Open Source versions 1.31.0 to 1.31.1;
• CVE-2026-42055: NGINX Plus and NGINX Open Source versions 1.13.10 to 1.31.1;