Nginx Leaves Dynamic Tables Unused in HTTP/2 and HTTP/3 Responses
Nginx applies header compression asymmetrically in both HTTP/2 and HTTP/3. While clients compress repeated headers after the first transmission, the server always emits full literals, keeping response header sizes constant regardless of repetition count.
Measurements on a minimal stand with four identical requests show server responses locked at 131 bytes under HTTP/3 and 129 bytes under HTTP/2. Client requests, by contrast, drop from 246 bytes to 8 bytes once the dynamic table is populated.
Inspection of release-1.31.3 reveals the root cause inside ngx_http_v3_filter_module.c: all twenty-two invocations of ngx_http_v3_encode_field_ri and ngx_http_v3_encode_field_lri pass a zero value for the dynamic flag, forcing every field to be encoded as a literal. The field-section prefix is likewise emitted with insert_count and delta_base set to zero. No server-side encoder stream of type 0x02 is ever opened.
The identical limitation exists in the HPACK implementation. The HTTP/2 filter module contains zero references to ngx_http_v2_hpack_t and explicitly sends a Dynamic Table Size Update of zero on the first HEADERS frame, disabling client-side table usage for server responses.
The receiving path, however, is fully functional. ngx_http_v3_table.c implements insertion, eviction, blocked-stream tracking and the default 4096-byte table capacity announced in the SETTINGS frame. Debug logs confirm that client-supplied headers are correctly inserted and later referenced by index.
The asymmetry is explicitly allowed by RFC 9204 §4.2, yet it eliminates the compression gains that motivated the introduction of QPACK and HPACK. The unused encoder code path also contributed to a use-after-free vulnerability (CVSS 9.2) in the QPACK decoder earlier this year.
Related articles
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.
Windows 11 Update KB5124010 Triggers Crashes in Battlefield 6 and Other Titles
An optional non-security update KB5124010 for Windows 11 versions 24H2 and 25H2 is causing sudden game crashes for players of Battlefield 6, Battlefield 2042, and titles using Easy Anti-Cheat. The patch, initially distributed to Windows Insider participants and later made available broadly in early September, leads to silent exits within 15-30 seconds or a few minutes after launch. Reinstalling games, verifying DirectX installations, and repairing anti-cheat components have failed to resolve the issue, while uninstalling KB5124010 has restored functionality in multiple cases. The crashes are suspected to stem from conflicts with anti-cheat systems, including Electronic Arts' Javelin used in Battlefield titles and Easy Anti-Cheat in games such as Wardogs, which reports error WD-L020-95bc94d86a0d. Microsoft has not officially confirmed any link to anti-cheat software, and the problems affect users across diverse hardware configurations. Players are advised to skip the optional update until further clarification or a fix is provided.
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.