CVE-2026-95101

NGINX Plus and NGINX Open Source have a data-plane flaw in ngx_http_v3_module. When HTTP/3 is in use and proxy_request_buffering is on, an unauthenticated remote attacker can inject data into a request that NGINX forwards to an upstream server. Published scoring rates the impact as low integrity of the proxied request only, with no confidentiality or availability impact and no control-plane exposure. Deployments of the supported NGINX products acting as an HTTP/3 reverse proxy with request buffering enabled are in scope; end-of-support versions were not evaluated. There is no known public proof of concept, and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Confirm whether HTTP/3 is enabled and the server is proxying requests with proxy_request_buffering on; only that configuration is affected. Apply the fixed NGINX Plus and NGINX Open Source builds from F5’s advisory for this CVE (exact fixed versions were not in the supplied data—use the vendor bulletin). Until patched, disable HTTP/3 on reverse-proxy listeners or turn proxy_request_buffering off where that is operationally acceptable, and review upstream logs for unexpected injected request data.