Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact


This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
F5 NGINX Plus unknown
Version Status Constraints
37.1.0 affected < 37.2.0.1
37.0.0 affected < 37.0.7.1
R36 affected < *
R35 affected < *
R34 affected < *
R33 affected < *
F5 NGINX Open Source unknown
Version Status Constraints
1.31.0 affected < 1.31.7
1.30.0 affected < 1.30.6
1.25.0 affected < *

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

To mitigate this vulnerability, you can disable the buffered proxy directive (configure proxy_request_buffering off). For more information, refer to the proxy_request_buffering page. https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering

References
Link Providers
https://my.f5.com/manage/s/article/K000162613 cve-icon cve-icon
History

Wed, 14 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title NGINX ngx_http_v3_module vulnerability
Weaknesses CWE-172
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-10-14T14:40:28.955Z

Reserved: 2026-09-30T17:31:09.137Z

Link: CVE-2026-95101

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T15:17:27.100

Modified: 2026-10-14T16:04:11.750

Link: CVE-2026-95101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses