CVE-2026-90439: NGINX ngx_http_v3_module Heap Buffer Overflow Vulnerability
Summary
CVE-2026-90439: NGINX ngx_http_v3_module vulnerability. Affects nginx versions >= 1.29.2, < 1.31.6. Fixed in 1.31.6. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-90439 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. It is widely used for serving static content, load balancing, and as a reverse proxy for various applications. The ngx_http_v3_module enables support for HTTP/3, which is the latest version of the HTTP protocol, designed to improve performance and security. However, a vulnerability has been identified in this module when used with certain versions of OpenSSL.
Vulnerability Detail
The vulnerability in the ngx_http_v3_module arises from a limited heap buffer overflow that can occur during the TLS handshake process when using HTTP/3 with OpenSSL versions less than or equal to 3.5.0. This issue manifests in a non-deterministic manner, meaning it can occur unpredictably, making it difficult for attackers to exploit directly. The potential consequences include denial-of-service (DoS) attacks on the NGINX system and limited data corruption, affecting the reliability and integrity of the services hosted on the server. Importantly, this vulnerability does not expose the control plane, indicating that it is a data plane issue only.
How To Fix
Minimum fixed version
1.31.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable HTTP/3 support in their NGINX configuration until they can upgrade to the patched version. This can be done by modifying the NGINX configuration file and removing or commenting out the relevant HTTP/3 directives.
Conclusion
The CVE-2026-90439 vulnerability in the NGINX ngx_http_v3_module poses a significant risk to systems using affected versions of NGINX with specific OpenSSL configurations. It is crucial to upgrade to the patched version to mitigate potential denial-of-service attacks and data corruption. Users are encouraged to implement the recommended fixes and monitor their systems for vulnerabilities.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-90439 is a vulnerability in the NGINX ngx_http_v3_module that can lead to a heap buffer overflow during TLS handshakes when using HTTP/3 with certain OpenSSL versions.
This vulnerability can cause denial-of-service (DoS) attacks and limited data corruption, impacting the availability and integrity of your services.
NGINX versions prior to 1.31.6 are affected when used with OpenSSL versions less than or equal to 3.5.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
If an immediate upgrade is not possible, consider disabling HTTP/3 support in your NGINX configuration as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
