NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nginx nginx-CVE-2026-90439.html: Buffer overflow when using ngx_http_v3_module

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4d4c2b6e-d433-11f1-a215-a0369f7f7be0 advisory.

    The OpenResty developers report:
    The nginx core was upgraded from nginx 1.31.1 to 1.31.8, which                 incorporates 12 CVE fixes, grouped by the first fixed version:
                1.31.2: HTTP/3 use-after-free (CVE-2026-42530), HTTP/2 and gRPC                 upstream buffer overflow (CVE-2026-42055), and charset conversion                 buffer overread (CVE-2026-48142); 1.31.3: buffer overflow                 involving map and regex (CVE-2026-42533), memory disclosure                 involving slice or background cache updates (CVE-2026-60005),                 and SSI use-after-free (CVE-2026-56434); 1.31.6: HTTP/3 heap                 buffer overflow with certain OpenSSL versions and                 configurations (CVE-2026-90439); 1.31.7: buffer overflow                 involving alias and rewrite (CVE-2026-15176), buffer overflow                 during variable expression evaluation (CVE-2026-93479), HTTP/3                 request body injection (CVE-2026-95101), TLS session ticket                 forgery (CVE-2026-97629), and AIO and SSI use-after-free                 (CVE-2026-97205).

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When
    asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI)
    page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.
    This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on
    systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
    Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX
    system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this
    is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are
    not evaluated. (CVE-2026-97205)

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the
    alias directive together with rewrite and a set or return directive referencing the $request_filename
    variable. Alternatively, the same result could be achieved when the $request_filename variable is used in
    an access log format directive. An unauthenticated attacker along with conditions beyond their control can
    exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the
    NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with
    Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This
    vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to
    possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3
    with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could
    happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the
    attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart
    and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-
    of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this
    is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are
    not evaluated. (CVE-2026-90439)

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and
    the root directive or access log format references the map's regex capture variables before referencing
    the map output variable. Alternatively, the same result could be achieved by using a non-cacheable
    variable in a string expression under certain conditions. An unauthenticated attacker along with
    conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may
    cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can
    execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can
    bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on
    the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a
    data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not
    evaluated. (CVE-2026-93479)

  - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When
    using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject
    data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the
    proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software
    versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-95101)

The version of nginx installed on the remote host is prior to 1.30.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-016 advisory.

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3     with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could     happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the     attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart     and/or limited data corruption.

    Impact:This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX     system or limited data corruption. There is no control plane exposure; this is a data plane issue only.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-90439)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6cf2ff4b-b38c-11f1-a655-3497f65b111b advisory.

    The Angie Software Team reports:
    When using an OpenSSL version without native HTTP/3 support                 (3.5.0 or earlier), if the default server for the address that                 accepted a regular HTTPS request also used HTTP/3 (the listen                 directive with the quic parameter, possibly on a different port),                 while a server block without HTTP/3 was selected by domain name                 (SNI), limited worker process memory corruption or a worker                 process crash could occur (CVE-2026-90439); the fix was ported                 from nginx 1.31.6.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of Nginx running on the remote host is prior to 1.30.5 or 1.31.x prior to 1.31.6. It is, therefore, affected by a heap-based buffer overflow vulnerability in the ngx_http_v3_module module that occurs when HTTP/3 is used with OpenSSL 3.5.0 and earlier under certain configurations, which can cause a limited heap buffer overflow in the NGINX worker process during a TLS handshake, potentially leading to a denial of service (DoS) or limited data corruption.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7dc8fd4b-b1a7-11f1-a655-3497f65b111b advisory.

    The nginx development team reports:
    Buffer overflow when using ngx_http_v3_module                 (CVE-2026-90439). Severity: medium.
    A heap memory buffer overflow might occur in a worker                 process under certain configurations when using HTTP/3 with                 OpenSSL 3.5.0 and earlier.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
374534	FreeBSD : OpenResty -- multiple vulnerabilities in the bundled nginx core (4d4c2b6e-d433-11f1-a215-a0369f7f7be0)	Nessus	FreeBSD Local Security Checks	Local	critical
476639	Alpine: multiple nginx packages: security update to 1.30.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
476639	Alpine: multiple nginx packages: security update to 1.30.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
351077	Amazon Linux 2 : nginx (ALASNGINX1-2026-016)	Nessus	Amazon Linux Local Security Checks	Local	medium
349288	FreeBSD : Angie -- worker process memory corruption when using HTTP/3 (6cf2ff4b-b38c-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	medium
115478	Nginx 1.31.x < 1.31.6 Heap-Based Buffer Overflow	Web App Scanning	Component Vulnerability	Version Based	medium
115477	Nginx < 1.30.5 Heap-Based Buffer Overflow	Web App Scanning	Component Vulnerability	Version Based	medium
346308	FreeBSD : nginx -- buffer overflow when using ngx_http_v3_module (7dc8fd4b-b1a7-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-90439

medium

Tenable Plugins

Coming Soon

critical

critical

critical

medium

medium

medium

medium

medium