CVE-2026-40460: NGINX ngx_quic_module vulnerability

Description

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 31% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NO

NGINX Open Source · F5

1.26.0 before 1.30.1 · source: vendor, NVD

NP

NGINX Plus · F5

R36 before R36 P4; R32 before R32 P6 · source: vendor, NVD

DO

Dos · F5

4.3.0 through 4.7.0; 4.8.0 · source: NVD

NG

Nginx Gateway Fabric · F5

1.3.0 through 1.6.2; 2.0.0 through 2.6.0 · source: NVD

NI

Nginx Ingress Controller · F5

3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 · source: NVD

NI

Nginx Instance Manager · F5

2.16.0 through 2.22.0 · source: NVD

WA

Waf · F5

4.9.0 through 4.16.0; 5.1.0 through 5.8.0; 5.9.0 through 5.12.1 · source: NVD