NGINX Open Source (versions using the HTTP/3 QUIC module)
NGINX is open-source web server software that sits in front of websites and applications to handle incoming traffic, widely used as a reverse proxy and load balancer across the internet.
Root Cause
The HTTP/3 module mismanages memory tied to QPACK encoder streams (a compression mechanism HTTP/3 uses to shrink header data). When a connection is reopened in a specific crafted sequence, the module can end up referencing memory that has already been freed, giving an attacker a foothold to corrupt it.
Attack Vector
A remote, unauthenticated attacker opens a specially crafted HTTP/3 session and reopens a QPACK encoder stream in a way that triggers the use-after-free. On systems where Address Space Layout Randomization (ASLR, a defense that randomizes where code sits in memory) is disabled, or where an attacker can bypass it, this can be escalated into full remote code execution.
Detection Notes
Watch for unusual or malformed HTTP/3 connection patterns in NGINX access logs, repeated QUIC stream resets from the same client, and unexpected NGINX worker process crashes or restarts.
Recommended Actions
- Apply F5's patch for NGINX Open Source immediately.
- If you cannot patch right away, disable the HTTP/3 QUIC module as an interim mitigation.
- Confirm ASLR is enabled on affected servers as a partial defense-in-depth measure while patching is underway.