CVE-2026-95101: 
NGINX vulnerability analysis and mitigation

CVE-2026-95101 is a data injection vulnerability in the ngx_http_v3_module module of NGINX Plus and NGINX Open Source. When HTTP/3 is used with the proxy_request_buffering on directive enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. Affected versions include NGINX Plus R33–R36, 37.0.0–37.0.7.1, and 37.1.0–37.2.0.1, as well as NGINX Open Source 1.25.0, 1.30.0–1.30.6, and 1.31.0–1.31.7. The vulnerability was published on October 14, 2026, and carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-172 (Encoding Error), where the ngx_http_v3_module fails to properly handle or validate data when HTTP/3 request buffering is active, allowing encoding-related manipulation of proxied request content. The attack vector is network-based, requires no authentication, no privileges, and no user interaction, making it trivially exploitable against any NGINX instance with HTTP/3 and proxy_request_buffering on configured. Attack patterns associated with this vulnerability include double encoding (CAPEC-120), URL encoding abuse (CAPEC-72), and UTF-8 encoding bypass (CAPEC-80), suggesting the injection leverages encoding ambiguities in the HTTP/3 parsing path. The vulnerability is limited to the data plane; there is no control plane exposure (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker to inject arbitrary data into HTTP requests proxied to backend servers, compromising the integrity of request content. This could enable request smuggling-style attacks, manipulation of backend application logic, or injection of malicious headers or body content that backend services process as legitimate. There is no confidentiality or availability impact reported; the scope is limited to integrity of the vulnerable system's data plane, with no lateral movement to subsequent systems (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

F5 has released patched versions addressing this vulnerability: NGINX Plus 37.0.7.1 and 37.2.0.1 (and later), and NGINX Open Source 1.30.6 and 1.31.7 (and later). Upgrading to a fixed version is the recommended remediation. As a temporary workaround, administrators can either disable HTTP/3 entirely or set proxy_request_buffering off if HTTP/3 must remain enabled, until patching is feasible. NGINX Plus versions R33–R36 should be upgraded to a supported, patched release (GitHub Advisory, F5 Advisory).

Coverage has been limited to automated vulnerability tracking platforms and Linux compatibility news outlets, with no notable researcher commentary or significant community discussion identified at this time (Linux Compatible).