Medium severity6.5NVD Advisory· Published May 13, 2026· Updated May 13, 2026

CVE-2026-40460

Description

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Nginx/Nginxllm-fuzzy
F5, Inc./Nginx Plusllm-fuzzy
osv-coords3 versions
pkg:bitnami/nginx pkg:bitnami/nginx-gateway pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed
>= 1.26.0, < 1.30.1+ 2 more
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: < 1.31.0-1.1

Patches

Vulnerability mechanics

References

my.f5.com/manage/s/article/K000161068nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000