CVE-2026-90439: 
NGINX vulnerability analysis and mitigation

CVE-2026-90439 is a heap-based buffer overflow vulnerability in the ngx_http_v3_module module of NGINX Plus and NGINX Open Source. It occurs when HTTP/3 is used in conjunction with OpenSSL versions ≤ 3.5.0 under certain configurations, triggering a limited heap buffer overflow during TLS handshake processing. The overflow occurs in a non-deterministic manner beyond the attacker's control. Affected versions include NGINX Open Source 1.29.2–1.31.6 and 1.30.4–1.30.5, and NGINX Plus 37.0.0.1–37.0.6.1 and 37.1.0.1–37.1.1.1. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, F5 Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in NGINX's HTTP/3 implementation (ngx_http_v3_module) triggered during TLS handshake processing when paired with OpenSSL ≤ 3.5.0. The overflow is non-deterministic and not directly controllable by an attacker, meaning exploitation cannot be reliably directed toward a specific memory target. No authentication or user interaction is required; a remote attacker need only initiate an HTTP/3 connection to a vulnerable NGINX instance using the affected OpenSSL version. No public proof-of-concept code has been identified (GitHub Advisory, F5 Advisory).

Successful exploitation may cause the NGINX worker process to crash and restart (denial of service) or result in limited, non-targeted data corruption of in-flight requests. There is no confidentiality impact, and the vulnerability is confined to the data plane — there is no control plane exposure. The scope of impact is limited to the affected NGINX worker process and does not extend to subsequent systems or enable lateral movement (GitHub Advisory, F5 Advisory).

No public proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" with automatable attack potential marked "yes," reflecting that the attack requires no authentication and can be triggered remotely at scale. The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, F5 Advisory).

1. Reconnaissance: Identify internet-facing NGINX instances with HTTP/3 enabled using tools like Shodan or Censys, filtering for servers advertising QUIC/HTTP3 support and running affected NGINX versions (Open Source 1.29.2–<1.31.6 or 1.30.4–<1.30.5; Plus 37.0.0.1–<37.0.6.1 or 37.1.0.1–<37.1.1.1).
2. Confirm OpenSSL version: Attempt to fingerprint the OpenSSL version in use (e.g., via TLS handshake metadata or server banners) to confirm it is ≤ 3.5.0, which is required for the vulnerability to be triggerable.
3. Initiate HTTP/3 connections: Send repeated HTTP/3 (QUIC) connection requests to the target NGINX server, triggering TLS handshake processing in the ngx_http_v3_module.
4. Trigger heap overflow: The non-deterministic heap buffer overflow may occur during handshake processing, potentially causing the NGINX worker process to crash and restart, resulting in a brief denial of service or limited data corruption of in-flight requests.

Note: Because the overflow is non-deterministic and beyond attacker control, reliable or targeted exploitation (e.g., for code execution) is not feasible with current knowledge (GitHub Advisory, F5 Advisory).

• Logs: Unexpected NGINX worker process crash/restart entries in system logs (e.g., nginx: worker process X exited on signal 11 in /var/log/nginx/error.log or syslog); repeated TLS handshake errors logged around the same timeframe.
• Process: Frequent, unexplained NGINX worker process restarts visible via process monitoring tools (e.g., systemctl status nginx, ps aux).
• Network: High volume of inbound QUIC/UDP connections (typically port 443) from a single or distributed set of source IPs, particularly if correlated with worker crashes.

F5 has released patched versions: NGINX Open Source 1.31.6 and 1.30.5, and NGINX Plus 37.0.6.1 and 37.1.1.1. Upgrading to these versions is the recommended remediation. As a workaround, operators can upgrade OpenSSL to a version greater than 3.5.0 or disable HTTP/3 support in NGINX configuration if an immediate upgrade is not feasible. Network-level rate limiting on TLS/QUIC handshake requests may reduce exposure as a temporary measure (F5 Advisory, GitHub Advisory, NGINX Releases).

The vulnerability received coverage from Linux-focused news aggregators and community sites, including LinuxCompatible and Warp2Search, which highlighted the patch releases for NGINX 1.30.5 and 1.31.6. A Hacker News thread was observed discussing the release. AUSCERT published a security bulletin (ESB-2026.11121) referencing the advisory. Community reaction has been measured, consistent with the moderate severity rating and absence of active exploitation (LinuxCompatible, AUSCERT).