The vulnerability is a use‑after‑free in the NGINX Open Source ngx_http_v3_module. An unauthenticated attacker can craft a special HTTP/3 session to reopen a QPACK encoder stream, which leads to an uninitialized memory use inside the worker process. When Address Space Layout Randomization is disabled or bypassed, this flaw can be turned into code execution on the affected system.

The flaw affects all NGINX Open Source deployments that enable the HTTP/3 QUIC module and load the ngx_http_v3_module. No specific product version is listed, but any instance configured with the module is potentially vulnerable. End‑of‑support releases are not evaluated and therefore are considered outside the scope of this assessment.

The CVSS score of 9.2 indicates a high‑severity weakness, but the EPSS score of <1% shows that exploitation is expected to be rare. The flaw is not listed in CISA’s KEV catalog. Attackers must be able to send malicious HTTP/3 traffic and control the QUIC connection; they also need the target to be running with ASLR disabled or to bypass ASLR to gain code‑execution capability.