Every CVE Search/ Get API key

CVE-2026-90439

NGINX ngx_http_v3_module vulnerability

6.9 MediumFix available

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.26%Unchanged since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-90439
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-78585 6.9

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
EUVD-2026-78585
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fjgw-pmcm-g7j7 6.9

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When...

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
GHSA-fjgw-pmcm-g7j7
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122
Updated
2026-11-02
NVD 6.9

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-90439
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-122
Updated
2026-11-02
OSVALPINE-CVE-2026-90439 6.9

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
ALPINE-CVE-2026-90439
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-90439 6.5
Record
BELL-CVE-2026-90439
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-90439 6.9

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
DEBIAN-CVE-2026-90439
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:67977 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:67977
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-90439 6.9

(NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...)

Record
UBUNTU-CVE-2026-90439
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVBIT-nginx-2026-90439 No score

NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-2026-90439
Updated
2026-11-02
OSVBIT-nginx-gateway-2026-90439 No score

NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-gateway-2026-90439
Updated
2026-11-02
OSVMGASA-2026-0499 No score

Updated nginx package fixes a security vulnerability

NGINX ngx_http_v3_module vulnerability. (CVE-2026-90439)

Record
MGASA-2026-0499
Updated
2026-11-02
OSVopenSUSE-SU-2026:11807-1 No score

nginx-1.31.6-1.1 on GA media

These are all security issues fixed in the nginx-1.31.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11807-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Alpine:v3.24
 before 1.30.6-r0
1.30.6-r0
nginx
Alpaquita:23
 1.22.1-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:23
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx
Alpaquita:25
 1.28.0-r3 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:25
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx
Alpaquita:stream
 1.22.1-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:stream
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
BellSoft Hardened Containers:23
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
BellSoft Hardened Containers:25
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
BellSoft Hardened Containers:stream
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
Show 17 moreShow less
Affected packages
PackageAffectedFixed
nginx
Bitnami
 1.29.2 up to 1.30.0, 1.30.4 up to 1.30.5, 1.31.0 up to 1.31.6
1.30.01.30.51.31.6
nginx-gateway
Bitnami
 1.29.2 up to 1.30.0, 1.30.4 up to 1.30.5, 1.31.0 up to 1.31.6
1.30.01.30.51.31.6
nginx
Debian:14
 before 1.30.4-7, plus listed versions
1.26.3-31.28.0-11.28.0-21.28.0-31.28.0-4
Show 28 moreShow less
1.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-21.30.4-31.30.4-41.30.4-51.30.4-6
1.30.4-7
nginx
Mageia:10
 before 1.30.5-1.mga10
1.30.5-1.mga10
nginx
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-all-modules
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-core
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-filesystem
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-devel
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-http-geoip
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-http-image-filter
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-http-perl
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-http-xslt-filter
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-mail
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-stream
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx-mod-stream-geoip
Red Hat:hummingbird:1
 before 0:1.30.5-4.hum1
0:1.30.5-4.hum1
nginx
openSUSE:Tumbleweed
 before 1.31.6-1.1
1.31.6-1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-90439 is a medium vulnerability (CVSS 6.9) in F5 Nginx Open Source, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in nginx 1.30.6-r0.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open