F5-K000162613: Medium severity F5 NGINX Plus vulnerability

Q: Which deployments are exposed to this issue?

The issue applies to NGINX Plus and NGINX Open Source deployments using the ngx_http_v3_module with HTTP/3 enabled and the proxy_request_buffering directive in use. The listed F5 NGINX-based products may be relevant where they include that configuration.

Q: What does an attacker need to exploit it?

An attacker may be able to exploit the issue remotely without authentication or user interaction. Successful exploitation depends on the affected HTTP/3 and proxy_request_buffering configuration being present.

Q: What is the potential impact?

An attacker may be able to inject data into a proxied request. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.

Published Oct 14, 2026

Updated

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Affected Software

12 affected componentsFixes available

F5 NGINX Plus>=37.1.0<=37.1.1, >=37.0.0<=37.0.6

37.2.0.137.0.7.1

F5 NGINX Plus=33

F5 NGINX Open Source>=1.31.0<=1.31.6, >=1.30.0<=1.30.5, >=1.25.0<=1.28.3

1.31.71.30.6

F5 NGINX Instance Manager>=2.18.0<=2.23.0

2.24.0

F5 F5 WAF for NGINX=5.15.0, >=5.9.0<=5.14.1

5.16.05.14.2

F5 F5 DoS for NGINX>=4.8.0<=4.10.0

4.11.0

F5 NGINX Gateway Fabric>=2.1.0<=2.7.2

2.8.0

F5 NGINX Gateway Fabric>=1.5.0<=1.6.2

F5 NGINX Ingress Controller>=3<=2026, =2026

F5 NGINX Ingress Controller>=5.0.0<=5.6.3

5.7.0

F5 NGINX Ingress Controller>=4.0.0<=4.0.1

F5 NGINX Ingress Controller>=3.7.1<=3.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.2.0.137.0.7.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0

Event History

Oct 14, 2026

Advisory Published

via F5·01:41 PM

Data Sourced

via F5·01:41 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue applies to NGINX Plus and NGINX Open Source deployments using the ngx_http_v3_module with HTTP/3 enabled and the proxy_request_buffering directive in use. The listed F5 NGINX-based products may be relevant where they include that configuration.

What does an attacker need to exploit it?