Description
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact


This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published: 2026-10-14
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Data Injection
Action: Apply Workaround
AI Analysis

Impact

The ngx_http_v3_module module in NGINX implements an HTTP/3 handler that, when proxy_request_buffering is enabled, allows an unauthenticated attacker to inject arbitrary data into the request forwarded to the backend service. This flaw does not expose the control plane; it affects only the data path of the proxy and can alter or forge requests sent to downstream applications.

Affected Systems

NGINX Plus and NGINX Open Source are affected. No specific version information is provided in the advisory.

Risk and Exploitability

The CVSS base score is 6.9 and the EPSS score is not available, while the vulnerability is not listed in CISA KEV. The likely attack vector is via a remote HTTP/3 connection to the NGINX server with proxy_request_buffering set to on, allowing an unauthenticated attacker to craft a request that injects data into the proxied traffic.

Generated by OpenCVE AI on October 15, 2026 at 01:08 UTC.

Remediation

Vendor Workaround

To mitigate this vulnerability, you can disable the buffered proxy directive (configure proxy_request_buffering off). For more information, refer to the proxy_request_buffering page. https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering

OpenCVE Recommended Actions

  • Disable the proxy_request_buffering directive (set proxy_request_buffering off) to prevent data injection via HTTP/3.
  • Verify the NGINX version using the vendor's advisory and upgrade to a version that includes the fix when it becomes available.
  • Configure the backend services to validate or sanitize input aggressively to mitigate the effects of any injected data that may still reach the application layer.

Generated by OpenCVE AI on October 15, 2026 at 01:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title NGINX ngx_http_v3_module vulnerability
Weaknesses CWE-172
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-10-15T16:43:46.630Z

Reserved: 2026-09-30T17:31:09.137Z

Link: CVE-2026-95101

cve-icon Vulnrichment

Updated: 2026-10-15T16:38:41.062Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T15:17:27.100

Modified: 2026-10-15T17:17:32.607

Link: CVE-2026-95101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T01:15:10Z

Weaknesses