NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nginx nginx-CVE-2026-90439.html: Buffer overflow when using ngx_http_v3_module

The version of nginx installed on the remote host is prior to 1.30.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-016 advisory.

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3     with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could     happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the     attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart     and/or limited data corruption.

    Impact:This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX     system or limited data corruption. There is no control plane exposure; this is a data plane issue only.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-90439)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6cf2ff4b-b38c-11f1-a655-3497f65b111b advisory.

    The Angie Software Team reports:
    When using an OpenSSL version without native HTTP/3 support                 (3.5.0 or earlier), if the default server for the address that                 accepted a regular HTTPS request also used HTTP/3 (the listen                 directive with the quic parameter, possibly on a different port),                 while a server block without HTTP/3 was selected by domain name                 (SNI), limited worker process memory corruption or a worker                 process crash could occur (CVE-2026-90439); the fix was ported                 from nginx 1.31.6.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of Nginx running on the remote host is prior to 1.30.5 or 1.31.x prior to 1.31.6. It is, therefore, affected by a heap-based buffer overflow vulnerability in the ngx_http_v3_module module that occurs when HTTP/3 is used with OpenSSL 3.5.0 and earlier under certain configurations, which can cause a limited heap buffer overflow in the NGINX worker process during a TLS handshake, potentially leading to a denial of service (DoS) or limited data corruption.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7dc8fd4b-b1a7-11f1-a655-3497f65b111b advisory.

    The nginx development team reports:
    Buffer overflow when using ngx_http_v3_module                 (CVE-2026-90439). Severity: medium.
    A heap memory buffer overflow might occur in a worker                 process under certain configurations when using HTTP/3 with                 OpenSSL 3.5.0 and earlier.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
351077	Amazon Linux 2 : nginx (ALASNGINX1-2026-016)	Nessus	Amazon Linux Local Security Checks	Local	medium
349288	FreeBSD : Angie -- worker process memory corruption when using HTTP/3 (6cf2ff4b-b38c-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	medium
115478	Nginx 1.31.x < 1.31.6 Heap-Based Buffer Overflow	Web App Scanning	Component Vulnerability	Version Based	medium
115477	Nginx < 1.30.5 Heap-Based Buffer Overflow	Web App Scanning	Component Vulnerability	Version Based	medium
346308	FreeBSD : nginx -- buffer overflow when using ngx_http_v3_module (7dc8fd4b-b1a7-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-90439

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium