NGINX Releases 1.30.5 and 1.31.6 to Patch HTTP/3 Buffer Overflow
The new stable and mainline builds close CVE-2026-90439, though only if you're actually serving QUIC traffic.
NGINX just published two releases in a single day. The NGINX Project shipped nginx 1.30.5 for the stable branch and nginx 1.31.6 for mainline, and both carry the same headline fix: a heap buffer overflow in the module that powers HTTP/3 over QUIC.
The change isn't cosmetic, either. Per the official changelog, the bug lives in the ngx_http_v3_module, and "a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier." The issue was reported by Banny Liao.
Now, before you panic and roll out a fleet-wide upgrade, there are some asterisks. This one only bites when you're actually serving HTTP/3, and only against OpenSSL 3.5.0 or older. If your servers are running plain HTTPS on HTTP/2, this release doesn't touch your day.
What the CVE actually does
CVE-2026-90439 lands at a CVSS 6.9, which NGINX and the GitHub Advisory database both classify as moderate. Network attack vector, remote, low complexity, no privileges required, no user interaction. The numbers look tame on paper.
Here's the catch. The GitHub advisory spells out that the overflow during the TLS handshake "can happen in a non-deterministic manner that is beyond the attacker's control." In practice, that means you can't reliably weaponize it to run arbitrary code. What you can do, though, is trigger a worker restart. That's a denial of service. Limited data corruption is on the table too, but the advisory is explicit that this is a data-plane issue, with no control-plane exposure.
So it's not a remote-code-execution nightmare. But "limited data corruption" and "you'll probably crash" are more than enough reason to patch if you serve QUIC.
Affected versions run from 1.29.2 to 1.31.5. Everything from 1.30.5 onward (stable) or 1.31.6 onward (mainline) is considered patched. NGINX does note that branches which have already hit End of Technical Support aren't evaluated, so if you're still running something older, start planning the upgrade now.
There's a small but interesting wrinkle tucked into 1.30.5. Beyond the CVE fix, the release now always ignores the QUIC transport parameters extension received during an SSL connection. Think of it as bolting a door that was left ajar. It shuts down a possible spoofing or confusion attack right at the TLS/QUIC handshake boundary, and it lines up with an earlier mitigation for QUIC connection migration (CVE-2026-40460, shipped in 1.30.1).
The pattern is hard to miss if you've been following NGINX's security notes. This HTTP/3 overflow is the newest entry in a run of QUIC advisories that have eaten most of the project's security bandwidth over roughly the past year. CVE-2026-42530 was a use-after-free, fixed in 1.31.2+. CVE-2026-40460 handled HTTP/3 address spoofing. And the whole thing traces back to CVE-2024-32760 and friends, a cluster of crash and memory-disclosure issues fixed in 1.27.0 and 1.26.1.
It says a lot that QUIC shipped as an experimental feature back in 1.25.0, in May 2023, and that the stack is still being hardened three-plus years later. That's not unusual for anything built on top of a brand-new protocol and a specific OpenSSL version, but it does explain why the current advisory pins the blame squarely on OpenSSL 3.5.0 and earlier.
nginx 1.31.6 brings the rest
If you're on stable, 1.30.5 is a surgical patch. Mainline 1.31.6 carries the exact same security fix and QUIC hardening, but it also drags in a pile of feature and bugfix commits that accumulated across the recent 1.31.x development cycles.
Take the binary-upgrade bug. NGINX found that a graceful in-place executable upgrade (nginx -s reload with a fresh binary) would break if you configured the Control API socket and built nginx with the Perl module. Annoying, and oddly specific.
Then there's the predicate-location handling. Errors while evaluating a predicate inside a "predicate location" were silently swallowed and treated as false. Errors during nested location resolution could get missed when regular-expression or predicate locations sat at the same level. Both fixes came from @arut (Alexander Ruthenberg).
One worth remembering: a corrupted binary base file for the geo directive with the ranges parameter could trigger a segmentation fault just while reading configuration. Mainline adds a CRC32 validation step to catch that before the file gets used.
You're also getting the broader 1.31.x feature set baked in. That means the Control API (new in 1.31.5), predicate locations, the native JSON request/response module (ngx_http_json_module), and the client_body_early_read directive.
Where to go from here
If you serve HTTP/3 with QUIC on OpenSSL 3.5.0 or older, you should move to 1.30.5 or 1.31.6 soon. Pick stable for production-critical setups; go mainline if you actually want those newer features and don't mind riding a bit closer to the edge.
Keep in mind that non-HTTP/3 deployments aren't exposed to this CVE at all, but 1.31.6's bugfixes are genuinely useful, which is a decent nudge toward mainline for those who want them.
Both builds are already live. Grab them from the official download page, or pull the release-1.30.5 and release-1.31.6 tags from GitHub.
