NGINX ngx_http_v3_module vulnerability
Summary
| CVE | CVE-2026-95101 |
|---|---|
| State | PUBLISHED |
| Assigner | f5 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 15:17:27 UTC |
| Updated | 2026-10-15 17:17:32 UTC |
| Description | Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
Risk And Classification
Primary CVSS: v4.0 6.9 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-172 | CWE-172 CWE-172
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | F5 | NGINX Plus | affected 37.1.0 37.2.0.1 custom | Not specified |
| CNA | F5 | NGINX Plus | affected 37.0.0 37.0.7.1 custom | Not specified |
| CNA | F5 | NGINX Plus | affected R36 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R35 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R34 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R33 * custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.31.0 1.31.7 custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.30.0 1.30.6 custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.25.0 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| my.f5.com/manage/s/article/K000162613 | [email protected] | my.f5.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: F5 acknowledges Hansol Lee (rabbit2747) of GOTROOT for bringing this issue to our attention and following the highest standards of coordinated disclosure. (en)
Additional Advisory Data
Workarounds
CNA: To mitigate this vulnerability, you can disable the buffered proxy directive (configure proxy_request_buffering off). For more information, refer to the proxy_request_buffering page. https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering