The ngx_http_v3_module module in NGINX implements HTTP/3 support. When proxy_request_buffering is enabled, an unauthenticated attacker can inject arbitrary data into the request that is forwarded to downstream services. The flaw only affects the data plane of the; the control plane remains untouched, so the attacker cannot change NGINX configuration or obtain administrative access.

Both F5:NGINX Open Source and F5:NGINX Plus are affected. No specific version information was provided in the advisory.

The CVSS base score of 6.9 indicates moderate risk, and the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. This flaw comes under CWE-172 and CWE-444. The likely attack vector is a remote HTTP/3 connection to the NGINX server with proxy_request_buffering on, where an unauthenticated attacker can craft requests that inject data into the proxied traffic.