NGINX
CVE-2024-31079: NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| NGINX Open Source 1.25 | 1.26.1 or later |
| NGINX Plus R30 | R32 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.