CVE-2026-95101

NGINX ngx_http_v3_module vulnerability

State: Published
Severity: 6.9 Medium
Published: Oct 14, 2026
Updated: Oct 15, 2026
Reserved: Sep 30, 2026

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	f5
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	f5

Weaknesses

CWE-172

Affected Products

Product	Versions
NGINX PlusF5	37.1.0 to before 37.2.0.1Affected 37.0.0 to before 37.0.7.1Affected R36 and laterAffected R35 and laterAffected R34 and laterAffected R33 and laterAffected
NGINX Open SourceF5	1.31.0 to before 1.31.7Affected 1.30.0 to before 1.30.6Affected 1.25.0 and laterAffected

References

https://my.f5.com/manage/s/article/K000162613vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.