NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.
Impact
This vulnerability may allow remote attackers to
inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| F5 | NGINX Plus | unknown |
|
|||||||||||||||||||||
| F5 | NGINX Open Source | unknown |
|
No data.
No data.
No data available yet.
Vendor Workaround
To mitigate this vulnerability, you can disable the buffered proxy directive (configure proxy_request_buffering off). For more information, refer to the proxy_request_buffering page. https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://my.f5.com/manage/s/article/K000162613 |
|
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |
| Title | NGINX ngx_http_v3_module vulnerability | |
| Weaknesses | CWE-172 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: f5
Published:
Updated: 2026-10-14T14:40:28.955Z
Reserved: 2026-09-30T17:31:09.137Z
Link: CVE-2026-95101
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-14T15:17:27.100
Modified: 2026-10-14T16:04:11.750
Link: CVE-2026-95101
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-172
Encoding Error