NGINX ngx_http_v3_module vulnerability

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

EPSS (exploitation in 30 days)

0.35% · top 72% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

• CWE-172 (opens in a new tab)All about CWE-172 and its CVEs

Affected products

• F5 · NGINX Plus

  • affected 37.1.0 – < 37.2.0.1
  • affected 37.0.0 – < 37.0.7.1
  • affected R36 – < *
  • affected R35 – < *
  • affected R34 – < *
  • affected R33 – < *

• F5 · NGINX Open Source

  • affected 1.31.0 – < 1.31.7
  • affected 1.30.0 – < 1.30.6
  • affected 1.25.0 – < *

What to do

Workaround: To mitigate this vulnerability, you can disable the buffered proxy directive (configure proxy_request_buffering off). For more information, refer to the proxy_request_buffering page. https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering

References (1)

• https://my.f5.com/manage/s/article/K000162613 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-95101](https://trackcve.app/badge/CVE-2026-95101.svg)](https://trackcve.app/cve/CVE-2026-95101)

Record last updated 15 Oct 2026, 16:43 UTC.