CVE-2026-95101

Awaiting Analysis Awaiting Analysis - Queue

HTTP/3 Request Injection in NGINX Plus and NGINX Open Source

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95101

EUVD

EUVD-2026-101119

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Plus 37.1.0
F5	NGINX	Plus 37.0.0
F5	NGINX	Plus R36
F5	NGINX	Plus R35
F5	NGINX	Plus R34
F5	NGINX	Plus R33
F5	NGINX	Open Source 1.31.0
F5	NGINX	Open Source 1.30.0
F5	NGINX	Open Source 1.25.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-172	The product does not properly encode or decode the data, resulting in unexpected values.

Attack-Flow Graph

Executive Summary

This vulnerability affects NGINX Plus and NGINX Open Source when using HTTP/3 with the proxy_request_buffering directive enabled. An unauthenticated attacker can inject data into proxied requests, potentially altering or manipulating the data sent to backend servers.

Detection Guidance

Detection involves checking for HTTP/3 usage with proxy_request_buffering enabled in NGINX configurations. Inspect configuration files for 'proxy_request_buffering on;' within HTTP/3 server blocks. Monitor logs for unusual request injection patterns or anomalies in proxied requests.

Impact Analysis

The impact includes potential data manipulation in proxied requests, which could lead to unauthorized changes in data sent to backend systems. This is a data plane issue with no control plane exposure, meaning it primarily affects data transmission rather than system control.

Compliance Impact

The vulnerability allows unauthenticated attackers to inject data into proxied requests when HTTP/3 with proxy_request_buffering is enabled. This could lead to unauthorized data manipulation, potentially violating compliance requirements for data integrity and confidentiality under standards like GDPR and HIPAA.

Mitigation Strategies

Disable the proxy_request_buffering directive in your NGINX configuration if HTTP/3 is enabled. Update NGINX Plus and NGINX Open Source to the latest patched versions as soon as they are available.

Hi! I’m here to help you understand CVE-2026-95101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70