NGINX ngx_http_v3_module vulnerability
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-95101
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-95101
NGINX Plus
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
NGINX Open Source
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "F5",
"modules": [
"ngx_http_v3_module"
],
"product": "NGINX Plus",
"versions": [
{
"status": "affected",
"version": "37.1.0",
"lessThan": "37.2.0.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "37.0.0",
"lessThan": "37.0.7.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "R36",
"lessThan": "*",
"versionType": "custom"
},
{
"status": "affected",
"version": "R35",
"lessThan": "*",
"versionType": "custom"
},
{
"status": "affected",
"version": "R34",
"lessThan": "*",
"versionType": "custom"
},
{
"status": "affected",
"version": "R33",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "F5",
"modules": [
"ngx_http_v3_module"
],
"product": "NGINX Open Source",
"versions": [
{
"status": "affected",
"version": "1.31.0",
"lessThan": "1.31.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.30.0",
"lessThan": "1.30.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.25.0",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-95101
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #29855 · Revision 1
- Added to Heist Feed
- Publisher date