Under CWE‑172, when NGINX Open Source is configured to proxy HTTP/2 traffic (proxy_http_version set to 2) and proxy_set_body is used, an attacker can inject custom frame headers and payload bytes into the upstream connection. This allows the attacker to alter the content or headers sent to upstream services, potentially injecting malicious data or modifying request semantics. The flaw does not directly expose a remote code execution path, but it can compromise the integrity of proxied requests and enable downstream services to process manipulated data.

The vulnerability affects F5:NGINX Open Source deployments that use the ngx_http_proxy_v2_module with HTTP/2 enabled. Specific affected version information is not listed in the CNA data; however, any installation configured with proxy_http_version 2 and proxy_set_body may be at risk, and versions no longer receiving support have not been evaluated.

The CVSS base score of 6.3 indicates a moderate risk, and the EPSS score is not available, suggesting unclear current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network based, requiring an attacker to send crafted HTTP/2 frames to the proxying endpoint. Successful exploitation would necessitate misconfiguration of the proxy module and does not require elevated privileges or local access.