VDB
CVE-2026-95101
CVE-2026-95101
PUBLISHED
CVSS 5.3 MEDIUM
Reported by f5 · Published October 14, 2026
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | 37.1.0, 37.0.0, R36 |
| F5 | NGINX Open Source | 1.31.0, 1.30.0, 1.25.0 |
| alpine | nginx | 0 |
| F5 | NGINX Open Source | 1.31.0, 1.30.0, 1.25.0 |
| wolfi | nginx-stable | 0 |
| F5 | NGINX Plus | R34, R33, 37.1.0 |
| wolfi | nginx-mainline | 0 |
Timeline
- Oct 14, 2026 Coalition ESS Score
- Oct 14, 2026 CVE Published
- Oct 15, 2026 EPSS Score
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 CVE Updated
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score