CVE-2026-95101: NGINX ngx_http_v3_module vulnerability

Published Oct 14, 2026

Updated

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with

proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

2 affected components

F5 NGINX Plus

F5 NGINX Open Source

Event History

Oct 14, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments of F5 NGINX Plus or F5 NGINX Open Source are exposed when they use the ngx_http_v3_module with HTTP/3 and have the proxy_request_buffering directive enabled.

Does exploitation require authentication or user interaction?

No. The vulnerability is described as exploitable by an unauthenticated remote attacker and does not require user interaction.

Is the management or control plane affected?

No. The issue is limited to the data plane; no control plane exposure is identified.