Medium severity · published Oct 14, 2026
CVE-2026-95101
NGINX ngx_http_v3_module vulnerability
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.
Impact
This vulnerability may allow remote attackers to
inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
NGINX Open Source · F5
1.31.0 before 1.31.7; 1.30.0 before 1.30.6; 1.25.0 · source: vendor
NP
NGINX Plus · F5
37.1.0 before 37.2.0.1; 37.0.0 before 37.0.7.1; R36; R35; R34; R33 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95101
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95101
vendor-advisory
https://my.f5.com/manage/s/article/K000162613
More from NGINX Open Source
8.2
CVE-2026-60005
NGINX ngx_http_slice_module vulnerability
8.2
CVE-2026-27654
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this…
8.1
CVE-2026-97205
NGINX ngx_http_core_module vulnerability
8.1
CVE-2026-93479
NGINX map directive and regex matching vulnerability
8.1
CVE-2026-15176
NGINX ngx_http_core_module vulnerability