CVE-2026-40460

A flaw was found in NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. A remote attacker could exploit this by spoofing their source IP address. This vulnerability allows for the bypass of authorization controls or rate limiting mechanisms, potentially leading to unauthorized access or resource abuse.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if the HTTP/3 QUIC module is not required, disable it in your NGINX configuration. This typically involves removing or commenting out the quic parameter from listen directives in your nginx.conf file. After modifying the configuration, a graceful reload or restart of the NGINX service is required for the changes to take effect. For example, use sudo systemctl reload nginx or sudo systemctl restart nginx.