Security incidents tagged HTTP/3. Newest first.
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)Since Oct 20, 2026
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
nginxClosed Oct 14, 2026
HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now. #HTTP3 #QPACK #Vulnerability t.co/ZU7h7ky0XX
HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃"Header Accordions"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 t.co/iIRxIHmhnu
QUICの多くの実装でのOOM "Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation" t.co/qEjI9cftas
