CVE-2026-90439
Received Received - Intake

Heap Buffer Overflow in NGINX Plus and NGINX Open Source via HTTP/3

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: F5 Networks

Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90439
EUVD
EUVD-2026-78585

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
nginx nginx_plus to 3.5.0 (inc)
nginx nginx_open_source to 3.5.0 (inc)
nginx nginx_plus *
nginx nginx_open_source *
openssl openssl to 3.5.0 (inc)
nginx nginx_plus to 3.5.0 (exc)
nginx nginx_open_source to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects NGINX Plus and NGINX Open Source when using HTTP/3 with OpenSSL versions <= 3.5.0 under certain configurations. It causes a limited heap buffer overflow during TLS handshake processing, potentially leading to a worker process restart or minor data corruption. The overflow occurs unpredictably and is not fully controllable by attackers.

Detection Guidance

Detecting this vulnerability requires checking for HTTP/3 usage with vulnerable OpenSSL versions and NGINX configurations. Monitor NGINX worker process crashes or restarts, especially during TLS handshakes. Check NGINX logs for unusual errors or heap-related issues. Verify OpenSSL version with 'openssl version' and NGINX version with 'nginx -v'.

Impact Analysis

This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on your NGINX system or result in limited data corruption. It only affects the data plane and does not expose the control plane.

Compliance Impact

The vulnerability may cause denial-of-service or limited data corruption in NGINX systems using HTTP/3 with vulnerable OpenSSL versions. This could impact compliance by disrupting data availability or integrity, which are key requirements under GDPR and HIPAA. However, the specific compliance impact depends on system configuration and data processing context.

Mitigation Strategies

Upgrade OpenSSL to a version > 3.5.0 immediately. Disable HTTP/3 in NGINX by removing 'http3' from the 'listen' directive in server blocks. Apply patches from NGINX if available. Restrict access to NGINX ports via firewalls as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart