NGINX
CVE-2026-40460: NGINX ngx_quic_module vulnerability
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| NGINX Plus R37 | Not affected |
| NGINX Plus R36 | R36 P4 or later |
| NGINX Plus R32 | R32 P6 or later |
| NGINX Open Source 1.31 | Not affected |
| NGINX Open Source 1.26 | 1.30.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.