Cis Nginx V300 4 1 12CAUTION

Open-source AI-powered offensive security harness for automated penetration testing.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cis-nginx-v300-4-1-12
description: "Ensure HTTP/3.0 is used (Manual)"
category: cis-nginx
version: "3.0"
author: cyberstrike-official
tags: [cis, nginx, web-server, reverse-proxy, tls-ssl, encryption, http3]
cis_id: "4.1.12"
cis_benchmark: "CIS NGINX Benchmark v3.0.0"
tech_stack: [nginx, linux, web-server]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS 4.1.12 — Ensure HTTP/3.0 is used

## Profile Applicability

- Level 2 - Webserver

## Description

HTTP/2 is the established standard for web communication, offering significant performance benefits over HTTP/1.1 through multiplexing. For 2025 and beyond, HTTP/3 should also be enabled. HTTP/3 operates over the **QUIC** protocol, which is built on **UDP**, to solve head-of-line blocking, reduce connection setup time, and improve performance on unreliable networks. Both protocols require a secure TLS 1.3 environment to function.

## Rationale

Enabling HTTP/2 provides a baseline of modern performance via stream multiplexing. Enabling HTTP/3 provides a further competitive advantage by mitigating TCP's head-of-line blocking and offering a faster, more reliable connection handshake, which is especially beneficial for mobile users. A server supporting **both** protocols can serve the vast majority of modern clients with the best possible performance and security. The strong encryption requirements of both protocols naturally align with a TLS 1.3-only policy.

## Impact

HTTP/2 has no significant negative impact as it is universally supported by modern clients. Enabling HTTP/3 has operational considerations:

1. **NGINX Build:** Your NGINX binary must be compiled with HTTP/3 and **QUIC** support. Standard OS packages may not include this. The repository of NGINX itself has the **http_v3** module since NGINX version 1.25.0

   Run this command and check if the **http_v3** module is present:

   ```bash
   nginx -V 2>&1 | tr ' ' '\n' | grep --color=auto 'with-'
   ```

2. **Firewall Configuration: You must allow UDP** traffic on port `443`, as HTTP/3 uses the **QUIC** protocol over **UDP**. This is a common oversight that will cause HTTP/3 to fail.

## Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration:

```bash
nginx -T 2>/dev/null | grep -E '^\s*(listen|add_header.*Alt-Svc)'
```

Verify the following in the output for your primary `server` block:

1. The TCP `listen` directive **includes** the `http2` parameter: `listen 443 ssl http2;`
2. A **UDP** `listen` directive with the `quic` parameter exists: `listen 443 quic reuseport;`
3. An `Alt-Svc` header is being sent to advertise HTTP/3 availability: `add_header Alt-Svc 'h3=":443"; ma=63072000';`

If any of these are missing, this recommendation is not fully implemented.

## Remediation

**Prerequisite:** Ensure your NGINX version is compiled with the `--with-http_v3_module` flag.

1. Open your NGINX server configuration file.
2. In the main `server` block for your HTTPS site, add or modify the directives to enable HTTP/2, HTTP/3, and advertise its availability.
3. Ensure your firewall **allows UDP** traffic on port `443`.

```nginx
server {
    # 1. Enable HTTP/2 on the standard TCP listener
    listen          443       ssl http2;
    listen          [::]:443 ssl http2;

    # 2. Enable HTTP/3 on the UDP listener
    listen          443       quic reuseport;
    listen          [::]:443 quic reuseport;

    # ... other ssl directives like ssl_certificate ...

    # 3. Advertise HTTP/3 availability to browsers
    # The max-age (ma) is in seconds (e.g., 2 years)
    add_header      Alt-Svc 'h3=":443"; ma=63072000';

    # Required for HTTP/3
    ssl_early_data  on;
}
```

## Default Value

By default, NGINX only enables HTTP/1.1. HTTP/2 and HTTP/3 must be explicitly configured.

## References

1. https://nginx.org/en/docs/http/ngx_http_v3_module.html
2. https://datatracker.ietf.org/doc/html/rfc9114
3. https://nginx.org/en/docs/http/ngx_http_v2_module.html

## CIS Controls

| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.10 Encrypt Sensitive Data in Transit            | N    | Y    | Y    |
| v7               | 14.4 Encrypt All Sensitive Information in Transit | N    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic            | Technique                                 |
| ----------------- | ----------------------------------------- |
| Credential Access | T1557 - Adversary-in-the-Middle           |
| Initial Access    | T1190 - Exploit Public-Facing Application |

## Profile

- Level 2 - Webserver

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (6)

packages/app/public/apple-touch-icon-v3.png

packages/app/public/apple-touch-icon.png

packages/app/public/favicon-96x96-v3.png

packages/app/public/favicon-96x96.png

packages/app/public/favicon-v3.ico

The repository of NGINX itself has the **http_v3** module since NGINX version 1.25.0

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Cis Nginx V300 4 1 12](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-4-1-12/badge.svg)](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-4-1-12/)

Not your listing, or something out of date? Claim or update your listing.