Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-90439 EUVD-2026-78585GHSA-fjgw-pmcm-g7j7

NGINX ngx_http_v3_module vulnerability

Published Sep 15, 2026 · Updated Sep 16, 2026 · Assigned by f5

Vendor: F5 Product: NGINX Open Source Product: NGINX Plus Package: nginx Package: nginx Package: nginx-stable Package: nginx-stable-config Package: nginx-stable-config-compat Package: nginx-stable-fastcgi-params Package: nginx-stable-mime-types Package: nginx-stable-mod-http_geoip Package: nginx-stable-mod-http_image_filter Package: nginx-stable-mod-http_perl Package: nginx-stable-mod-http_xslt_filter Package: nginx-stable-mod-mail Package: nginx-stable-mod-stream Package: nginx-stable-mod-stream_geoip Package: nginx-stable-package-config Package: nginx-stable-scgi-params Package: nginx-stable-src Package: nginx-stable-syslog-config Package: nginx-stable-uwsgi-params Category: Network devices Ecosystem: Alpine Ecosystem: Debian Ecosystem: Wolfi

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

VendorProductAffectedFixed
F5 NGINX Plus 37.1.0.1 – < 37.1.1.2, 37.0.0.1 – < 37.0.6.2 37.1.1.2
F5 NGINX Open Source 1.29.2 – < 1.31.6, 1.30.4 – < 1.30.5 1.31.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nginx 1.30.4-7 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 nginx +11 1.30.5-4.hum1 RHSA-2026:67977

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nginx 1.31.6-1.1 openSUSE-SU-2026:11807-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 nginx 1.30.6-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nginx-stable +16 1.30.5-r2 —

Advisories 3

References