CVE-2026-90439 in NGINX Plus
Summary
by MITRE • 09/15/2026
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in NGINX Plus and NGINX Open Source resides within the ngx_http_v3_module, specifically affecting configurations that utilize HTTP/3 with OpenSSL versions 3.5.0 or earlier. This flaw manifests as a limited heap buffer overflow during the processing of Transport Layer Security handshakes. The nature of this vulnerability is characterized by its non-deterministic execution, meaning the occurrence and specific impact are not fully controllable by an attacker through standard exploitation techniques. Instead, the condition arises under specific configuration states where the interaction between NGINX’s HTTP/3 implementation and the underlying OpenSSL library creates a memory management error during handshake negotiation.
From a technical perspective, this issue falls under CWE-122, which describes heap-based buffer overflows. These types of vulnerabilities occur when a program writes data beyond the boundaries of a allocated heap region. In the context of NGINX, the worker process handles incoming connections and performs cryptographic operations via OpenSSL. When processing certain TLS handshake messages within an HTTP/3 session, insufficient bounds checking or incorrect memory allocation logic can lead to writing past the end of a buffer. Because this is a data plane issue rather than a control plane exposure, it does not allow for direct command execution or administrative access but instead impacts the stability and integrity of the web server's runtime environment.
The operational impact of this vulnerability is primarily centered on service availability and potential data integrity issues. An attacker can trigger this condition by initiating HTTP/3 connections with crafted TLS handshake packets that exploit the buffer overflow state. The immediate consequence is often a crash or restart of the NGINX worker process, leading to a denial-of-service for clients attempting to connect via HTTP/3. Additionally, because it involves heap corruption, there is a risk of limited data corruption within the memory space of the affected process. This can lead to unpredictable behavior, including silent data errors or further instability in subsequent operations if the process does not terminate immediately.
In terms of threat modeling and industry standards, this vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion through application layer attacks. The non-deterministic nature of the exploit makes it less suitable for reliable remote code execution but highly effective as a vector for persistent denial-of-service campaigns against services relying on HTTP/3 and older OpenSSL versions. Security teams should recognize that while full system compromise is not guaranteed, the reliability of high-performance web servers can be significantly degraded by such memory corruption flaws.
Mitigation strategies focus primarily on software updates and configuration adjustments. The most effective remediation is to upgrade NGINX Open Source or NGINX Plus to a version where this vulnerability in the ngx_http_v3_module has been patched. For environments unable to immediately update, administrators should consider disabling HTTP/3 support if it is not strictly required for their operational needs. Additionally, ensuring that the underlying OpenSSL library is updated to a version newer than 3.5.0 may resolve the issue, provided the NGINX build supports such updates without breaking other dependencies. Regular monitoring of worker process logs for unexpected restarts can also serve as an early detection mechanism for exploitation attempts in production environments.