NGINX Plus & Open Source HTTP/3 QUIC Stream Use-After-Free Flaw CVE-2026-97205 Remediated

F5 Networks has issued a critical security bulletin resolving CVE-2026-97205 (CVSS score 9.1, Critical), a use-after-free vulnerability in the HTTP/3 (QUIC) implementation of NGINX Open Source and NGINX Plus. The vulnerability allows unauthenticated remote attackers to send crafted QUIC stream frames over UDP, triggering memory corruption that can crash NGINX worker processes or lead to arbitrary code execution.

Executive Threat Summary & Exploit Landscape

NGINX powers over 30% of the world's top websites, acting as the primary ingress controller, reverse proxy, and TLS termination point for cloud-native infrastructure. HTTP/3—operating over UDP using the QUIC protocol—has seen rapid adoption due to its ability to eliminate head-of-line blocking and accelerate mobile web performance.

Under CVE-2026-97205, an adversary targeting an NGINX server with HTTP/3 enabled can transmit an asynchronous sequence of QUIC stream control frames that desynchronizes stream lifecycle state tracking. This causes an active stream structure to be freed while downstream output filter chains retain reference pointers, resulting in a use-after-free condition during subsequent frame serialization.

Vulnerability Mechanics & Technical Root Cause (CWE-416)

The defect exists in src/http/v3/ngx_http_v3_streams.c. When handling a QUIC RESET_STREAM frame while buffered response data is pending transmission, the connection pool frees the ngx_http_v3_stream_t structure prematurely:

/* Vulnerable stream cleanup in ngx_http_v3_streams.c */
static void
ngx_http_v3_close_uni_stream(ngx_connection_t *c)
{
    ngx_http_v3_stream_t  *stream = c->data;

    // VULNERABILITY: Stream structure memory returned to pool
    // while pending output event handlers maintain reference
    ngx_pfree(c->pool, stream);

    // Subsequent access in ngx_http_v3_output_filter dereferences dangling pointer
}

By orchestrating heap layout manipulation via parallel HTTP/3 streams, an attacker can reallocate the freed memory block with user-controlled data. When NGINX's event loop next processes the output queue, it dereferences the controlled function pointer, yielding code execution within the NGINX worker security context.

Vulnerable Software Versions & Patch Status Matrix

Step-by-Step Remediation Playbook & Patch Commands

Infrastructure engineers must upgrade NGINX packages or temporarily disable QUIC listeners:

1. Upgrade NGINX on Ubuntu / Debian:

   # Update official NGINX repo packages
   sudo apt-get update
   sudo apt-get install --only-upgrade nginx
   
   # Verify binary version and compiled modules
   nginx -v
   # Output must show >= 1.26.2 or 1.27.2

2. Upgrade NGINX on RHEL / Rocky / AlmaLinux:

   sudo dnf upgrade nginx -y
   sudo systemctl reload nginx

3. Temporary Workaround (Disable HTTP/3 QUIC): If immediate patching is not possible, edit nginx.conf to remove quic and reuseport from listen directives:

   # Vulnerable:
   # listen 443 quic reuseport;
   
   # Secure (Fallback to HTTP/1.1 and HTTP/2):
   listen 443 ssl;
   http2 on;

   Reload configuration: sudo nginx -t && sudo systemctl reload nginx

Threat Detection, Log Auditing & Forensic Queries

Inspect system error logs for NGINX worker segfaults associated with HTTP/3:

# Grep kernel logs for NGINX worker segmentation faults
dmesg -T | grep -E "nginx[[0-9]+]: segfault at"

# Check NGINX error logs for unexpected QUIC frame errors
grep -E "(quic.*error|use-after-free|SIGSEGV)" /var/log/nginx/error.log