cis-nginx-v300-4-1-12

name	cis-nginx-v300-4-1-12
description	Ensure HTTP/3.0 is used (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","tls-ssl","encryption","http3"]
cis_id	4.1.12
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 4.1.12 — Ensure HTTP/3.0 is used

Profile Applicability

• Level 2 - Webserver

Description

HTTP/2 is the established standard for web communication, offering significant performance benefits over HTTP/1.1 through multiplexing. For 2025 and beyond, HTTP/3 should also be enabled. HTTP/3 operates over the QUIC protocol, which is built on UDP, to solve head-of-line blocking, reduce connection setup time, and improve performance on unreliable networks. Both protocols require a secure TLS 1.3 environment to function.

Rationale

Enabling HTTP/2 provides a baseline of modern performance via stream multiplexing. Enabling HTTP/3 provides a further competitive advantage by mitigating TCP's head-of-line blocking and offering a faster, more reliable connection handshake, which is especially beneficial for mobile users. A server supporting both protocols can serve the vast majority of modern clients with the best possible performance and security. The strong encryption requirements of both protocols naturally align with a TLS 1.3-only policy.

Impact

HTTP/2 has no significant negative impact as it is universally supported by modern clients. Enabling HTTP/3 has operational considerations:

1. NGINX Build: Your NGINX binary must be compiled with HTTP/3 and QUIC support. Standard OS packages may not include this. The repository of NGINX itself has the http_v3 module since NGINX version 1.25.0

   Run this command and check if the http_v3 module is present:

   nginx -V 2>&1 | tr ' ' '\n' | grep --color=auto 'with-'
   

2. Firewall Configuration: You must allow UDP traffic on port 443, as HTTP/3 uses the QUIC protocol over UDP. This is a common oversight that will cause HTTP/3 to fail.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration:

nginx -T 2>/dev/null | grep -E '^\s*(listen|add_header.*Alt-Svc)'

Verify the following in the output for your primary server block:

1. The TCP listen directive includes the http2 parameter: