NGINX Plus and NGINX Open Source HTTP/3 QUIC Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in NGINX Plus and NGINX Open Source versions 1.25.0 prior to 1.25.4, and 1.26.0, when the experimental HTTP/3 QUIC module is enabled. Undisclosed requests can cause NGINX worker processes to crash, disrupting traffic until the process restarts.

Impact

Exploitation of this vulnerability leads to a crash of the NGINX worker process, causing a temporary disruption in service until the process is restarted.

Remediation

Users can upgrade to NGINX versions 1.25.4 or 1.27.0. If using NGINX Plus, refer to the NGINX Plus release notes for the appropriate version. For NGINX Open Source, version 1.25.4 includes the fix. Alternatively, the HTTP/3 module can be disabled in the NGINX configuration.