CVE-2026-49457: QUIC Package TLS Verification Flaw Allows Man-in-the-Middle Attacks
Summary
CVE-2026-49457: QUIC has Broken TLS verification. Affects quic versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The QUIC package is a transport layer network protocol designed to improve web performance by reducing latency and enhancing security. It is widely used in HTTP/3, providing a reliable and efficient communication channel. However, a critical vulnerability has been identified in the QUIC client, which fails to authenticate the server during the TLS 1.3 handshake, exposing users to potential security risks.
Vulnerability Detail
The vulnerability arises from the QUIC client's failure to properly authenticate the server during the TLS 1.3 handshake. Specifically, the CertificateVerify signature is not checked, the certificate chain is not validated, and the hostname is not compared against the certificate. This oversight effectively renders the client's verification process a no-op, allowing a man-in-the-middle attacker to present any certificate and impersonate any server. As a result, the confidentiality and integrity of the connection are compromised, making it possible for attackers to intercept and manipulate data. This issue also affects HTTP/3, which relies on the same client. Handshakes authenticated by a PSK (session resumption) are not impacted, as the peer is authenticated through the PSK binder without the need for a certificate.
How To Fix
Minimum fixed version
1.4.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds prior to version 1.4.4. Setting verify => false will allow the acceptance of any certificate, but this is not recommended as it exposes the connection to security risks. The correct approach is to update to the patched version.
Conclusion
The QUIC package has a critical vulnerability (CVE-2026-49457) that compromises TLS verification, allowing man-in-the-middle attacks. Users are urged to update to version 1.4.4 or later to ensure proper server authentication and protect their data integrity.
See every vulnerability recorded for quic →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Not fixing this vulnerability can lead to man-in-the-middle attacks, where an attacker can intercept and manipulate data transmitted between the client and server.
There are no effective mitigations available before updating to version 1.4.4. It is strongly recommended to update to the patched version as soon as possible.
The QUIC package is a transport layer protocol that enhances web performance by reducing latency and improving security, particularly in HTTP/3 communications.
