Description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.
Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | NGINX Plus | R31 – < R31 P1, R30 – < R30 P2 | R31 P1 |
| F5 | NGINX Open Source | 1.25.0 – < 1.25.4 | 1.25.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.26.0-1 | — |
| Debian 13 | nginx | 1.26.0-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nginx-mainline | 1.25.4-r0 | — |
Advisories 4
- ICSA-25-226-17 Siemens SINEC Traffic Analyzer CISA ICS & IT advisories · Aug 12, 2025
- SSA-517338 SSA-517338: Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0 Siemens ProductCERT · Aug 12, 2025
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-0395 NGINX und NGINX NGINX Plus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 29, 2024