NGINX Plus and NGINX Open Source CVE-2026-40460

The vulnerability requires explicit configuration of the HTTP/3 QUIC module in NGINX. Exploitation is contingent on: (1) QUIC module being compiled and enabled in the NGINX installation, (2) QUIC being actively configured in NGINX configuration files (presence of 'listen' directives with 'quic' or 'http3' parameters), and (3) HTTP/3 traffic being exposed to untrusted networks or environments where source IP spoofing is possible (UDP spoofing constraints apply - typically unrestricted on the Internet but limited on some internal networks with strict egress filtering). Default NGINX installations without explicit QUIC configuration are not vulnerable. Authorization or rate-limiting policies must rely on source IP as a decision factor for exploitation to have meaningful impact.

CVSS 6.5 with AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation requiring no authentication or user interaction, creating a low barrier to attack. EPSS data not provided, limiting probabilistic exploitation assessment. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog at time of analysis, suggesting no confirmed active exploitation in the wild, though source IP spoofing in QUIC is a well-understood attack vector in academic literature. The impact is constrained to authorization and rate-limiting bypasses (confidentiality and availability impacts rated 'Low' in CVSS) rather than remote code execution, reducing practical risk for most deployments. However, organizations relying on IP-based access controls or rate-limiting as primary security mechanisms face elevated risk. The limited scope (Unchanged) indicates the attack does not escape the vulnerable component to affect other services. The real-world priority depends on deployment prevalence: HTTP/3 QUIC adoption in NGINX remains moderate compared to HTTP/2 and HTTP/1.1, potentially limiting affected population.

An attacker sends HTTP/3 QUIC packets with a forged source IP address belonging to a trusted network or a rate-limited competitor. NGINX's QUIC module fails to properly validate the source address, accepting the spoofed origin. The attacker then performs requests that would normally be blocked by IP-based authorization rules or rate limits, such as accessing restricted APIs or launching brute-force attacks without triggering per-IP rate-limit thresholds. No publicly disclosed POC is referenced in available data.