Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-15T15:17:27.023Z",
  "pubdate": "2026-09-15T15:17:27.023Z",
  "executiveSummary": "A heap buffer overflow vulnerability has been identified in the ngx_http_v3_module of NGINX Plus and NGINX Open Source. The vulnerability manifests during the TLS handshake process when utilizing the HTTP/3 protocol in conjunction with OpenSSL versions 3.5.0 and earlier. This issue is categorized as a memory safety flaw within the data plane, potentially leading to unauthorized memory access and process-level instability. The primary security impact involves remote denial-of-service (DoS) capabilities, as the overflow can force the NGINX worker process to crash and restart. In certain scenarios, the memory corruption may result in limited data integrity issues. Because the manifestation of this overflow is non-deterministic and resides outside the direct control of an attacker, the ability to achieve reliable arbitrary code execution is significantly constrained. The vulnerability exists exclusively within the data plane, posing no risk of control plane exposure or administrative compromise. Affected deployments are advised to monitor official vendor updates to address the underlying memory handling error in the HTTP/3 module.",
  "technicalDetails": "The root cause of the vulnerability resides in the memory management logic of the ngx_http_v3_module when interfacing with OpenSSL during the TLS handshake phase of an HTTP/3 connection. Specifically, the interaction between the NGINX implementation and OpenSSL versions up to 3.5.0 triggers an out-of-bounds write to the heap under specific, non-deterministic conditions. As NGINX processes incoming TLS handshake packets via the QUIC protocol, the internal buffer management within the ngx_http_v3_module fails to properly validate the size of data segments against the allocated heap space.\nThe attack flow begins when a remote client initiates a TLS handshake over HTTP/3. During the exchange of handshake-related metadata, the NGINX worker process encounters a state that requires memory allocation or buffer copying. Due to the discrepancy in how OpenSSL manages its internal structures and how the ngx_http_v3_module handles these memory buffers, an overflow occurs. Because the trigger mechanism is non-deterministic—relying on the specific alignment of the handshake data and the state of the heap—an attacker cannot precisely control the offset or the content of the overwritten memory. This limits the exploit's utility to inducing a segmentation fault or a managed restart of the NGINX worker process, thereby facilitating a denial-of-service condition.\nThe impact of the overflow is localized to the worker process's memory space. While heap corruption can sometimes lead to arbitrary code execution, the non-deterministic nature of this specific overflow renders it ineffective for deterministic code injection. Instead, the corruption of adjacent memory blocks leads to erratic behavior, such as data corruption for concurrent requests handled by the same worker or, most commonly, the termination of the process by the operating system's memory protection mechanisms. There is no requirement for authentication to trigger this vulnerability, as it occurs during the initial connection setup. The vulnerability is restricted to the data plane, meaning that the NGINX management interface, configuration files, and underlying system binaries remain outside the direct scope of the exploit. This vulnerability specifically targets the HTTP/3 stack implementations where the integration with older versions of OpenSSL is active. Deployment environments utilizing HTTP/3 in production should be evaluated for this risk until patches addressing the buffer management logic within the ngx_http_v3_module are deployed."
}