NGINX has released versions 1.30.5 (stable) and 1.31.6 (mainline) to address a heap buffer overflow vulnerability (CVE-2026-90439) in the HTTP/3 module that affects OpenSSL 3.5.0 and earlier. The vulnerability could lead to worker-process crashes or limited data corruption but does not pose a risk of remote code execution. While the stable version focuses on security and hardening, the mainline version includes additional bug fixes and new features such as the Control API and JSON module. Users serving HTTP/3 with QUIC on older OpenSSL versions are advised to upgrade promptly, while those using plain HTTP/2 are not affected by this CVE
NGINX 1.30.5 and 1.31.6 Released: Patch for HTTP 3 Buffer Overflow (CVE-2026-90439)
NGINX released nginx 1.30.5 (stable) and 1.31.6 (mainline) today, both fixing CVE-2026-90439, a CVSS 6.9 heap buffer overflow in the HTTP/3 module that occurs only with OpenSSL 3.5.0 and earlier. The vulnerability affects versions 1.29.2 through 1.31.5 and can cause worker-process crashes or limited data corruption, though exploitation is non-deterministic and poses no control-plane or remote-code-execution risk. The stable 1.30.5 is a focused security-and-hardening patch, while mainline 1.31.6 additionally bundles bugfixes and new features like the Control API, JSON module, and predicate locations. Sites serving QUIC on older OpenSSL should upgrade soon, while plain HTTP/2 deployments are unaffected by this CVE.
