Executive brief
NGINX Open Source is a widely used web server and load balancer. A vulnerability in its HTTP/3 module could allow an attacker to crash the server or potentially take control of the system. This could lead to service outages or unauthorized access to sensitive data, particularly on systems where standard security protections like ASLR are disabled.
Technical details
A use-after-free vulnerability exists in the NGINX ngx_http_v3_module when HTTP/3 QUIC is enabled. A remote, unauthenticated attacker can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream, triggering the memory corruption. While the attack requires specific timing conditions beyond the attacker's direct control (High Attack Complexity), a successful exploit can lead to a Denial of Service (worker process restart) or remote code execution. Code execution is specifically noted as viable on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. The issue is addressed in NGINX Open Source version 1.31.2.
Affected products
- F5 NGINX Open Source 1.31.0 to 1.31.2
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory