Every CVE Search/ Get API key

CVE-2026-95101

NGINX ngx_http_v3_module vulnerability

6.9 MediumFix available

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.35%Up 0.1 points since Oct 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-95101
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-172
Updated
2026-11-02
EUVDEUVD-2026-101119 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
EUVD-2026-101119
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g6r5-95cx-mpp9 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module...

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
GHSA-g6r5-95cx-mpp9
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-172
Updated
2026-11-02
NVD 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-95101
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-172
Updated
2026-11-02
OSVALPINE-CVE-2026-95101 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
ALPINE-CVE-2026-95101
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-95101 5.3
Record
BELL-CVE-2026-95101
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2026-95101 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
DEBIAN-CVE-2026-95101
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:83427 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:83427
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-95101 6.9

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
UBUNTU-CVE-2026-95101
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-108449 No score

CVE-2026-95101 affecting package nginx for versions less than 1.30.6-1

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
AZL-108449
Updated
2026-11-02
OSVBIT-nginx-2026-95101 No score

NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-2026-95101
Updated
2026-11-02
OSVBIT-nginx-gateway-2026-95101 No score

NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-gateway-2026-95101
Updated
2026-11-02
OSVopenSUSE-SU-2026:12143-1 No score

nginx-1.31.7-1.1 on GA media

These are all security issues fixed in the nginx-1.31.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12143-1
Updated
2026-11-02
OSVUSN-8955-1 No score

nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176)

It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479)

It was discovered that nginx incorrectly handled HTTP/3 requests when proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101)

It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205)

It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

Record
USN-8955-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Alpine:v3.24
 before 1.30.6-r0
1.30.6-r0
nginx
Azure Linux:3
 before 1.30.6-1
1.30.6-1
nginx
Alpaquita:23
 1.22.1-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:23
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx
Alpaquita:25
 1.28.0-r3 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:25
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx
Alpaquita:stream
 1.22.1-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
Alpaquita:stream
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
BellSoft Hardened Containers:23
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx-base
BellSoft Hardened Containers:25
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
Show 25 moreShow less
Affected packages
PackageAffectedFixed
nginx-base
BellSoft Hardened Containers:stream
 1.30.3-r0 up to 1.30.6-r0
1.30.6-r0
nginx
Bitnami
 1.25.0 up to 1.29.0, 1.30.0 up to 1.30.6, 1.31.0 up to 1.31.7
1.29.01.30.61.31.7
nginx-gateway
Bitnami
 1.25.0 up to 2.2.1
2.2.1
nginx
Debian:12
 All versions, plus listed versions
1.22.1-91.22.1-9+deb12u11.22.1-9+deb12u101.22.1-9+deb12u21.22.1-9+deb12u3
Show 45 moreShow less
1.22.1-9+deb12u41.22.1-9+deb12u51.22.1-9+deb12u61.22.1-9+deb12u71.22.1-9+deb12u81.22.1-9+deb12u91.24.0-11.24.0-1~exp11.24.0-21.26.0-11.26.0-1~exp11.26.0-21.26.0-31.26.2-11.26.3-11.26.3-21.26.3-31.28.0-11.28.0-21.28.0-31.28.0-41.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-2
 None known
nginx
Debian:13
 before 1.26.3-3+deb13u10, plus listed versions
1.26.3-31.26.3-3+deb13u11.26.3-3+deb13u21.26.3-3+deb13u31.26.3-3+deb13u4
Show 5 moreShow less
1.26.3-3+deb13u51.26.3-3+deb13u61.26.3-3+deb13u71.26.3-3+deb13u81.26.3-3+deb13u9
1.26.3-3+deb13u10
nginx
Debian:14
 before 1.30.4-8, plus listed versions
1.26.3-31.28.0-11.28.0-21.28.0-31.28.0-4
Show 29 moreShow less
1.28.0-51.28.0-61.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.2-31.28.2-41.28.3-11.28.3-21.30.0-11.30.0-21.30.0-31.30.0-41.30.1-11.30.1-21.30.1-31.30.1-41.30.1-51.30.1-61.30.1-71.30.4-11.30.4-21.30.4-31.30.4-41.30.4-51.30.4-61.30.4-7
1.30.4-8
nginx
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-all-modules
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-core
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-filesystem
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-http-geoip
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-http-image-filter
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-http-perl
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-http-xslt-filter
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-mail
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-stream
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx-mod-stream-geoip
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.30.6-1.hum1
0:1.30.6-1.hum1
nginx
Ubuntu:26.10
 before 1.30.4-7ubuntu1.1, plus listed versions
1.28.3-2ubuntu11.30.1-4ubuntu11.30.1-6ubuntu11.30.4-5ubuntu11.30.4-7ubuntu1
1.30.4-7ubuntu1.1
nginx
Ubuntu:26.04:LTS
 before 1.28.3-2ubuntu1.12, plus listed versions
1.28.0-6ubuntu11.28.1-2ubuntu11.28.1-3ubuntu11.28.2-2ubuntu11.28.3-2ubuntu1
Show 11 moreShow less
1.28.3-2ubuntu1.11.28.3-2ubuntu1.21.28.3-2ubuntu1.31.28.3-2ubuntu1.41.28.3-2ubuntu1.51.28.3-2ubuntu1.61.28.3-2ubuntu1.71.28.3-2ubuntu1.81.28.3-2ubuntu1.91.28.3-2ubuntu1.101.28.3-2ubuntu1.11
1.28.3-2ubuntu1.12
nginx
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 1.18.0-6ubuntu14.22, plus listed versions
1.18.0-6ubuntu111.18.0-6ubuntu121.18.0-6ubuntu141.18.0-6ubuntu14.11.18.0-6ubuntu14.2
Show 18 moreShow less
1.18.0-6ubuntu14.31.18.0-6ubuntu14.41.18.0-6ubuntu14.51.18.0-6ubuntu14.61.18.0-6ubuntu14.71.18.0-6ubuntu14.81.18.0-6ubuntu14.101.18.0-6ubuntu14.111.18.0-6ubuntu14.121.18.0-6ubuntu14.131.18.0-6ubuntu14.141.18.0-6ubuntu14.151.18.0-6ubuntu14.161.18.0-6ubuntu14.171.18.0-6ubuntu14.181.18.0-6ubuntu14.191.18.0-6ubuntu14.201.18.0-6ubuntu14.21
1.18.0-6ubuntu14.22
nginx
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 1.24.0-2ubuntu7.19, plus listed versions
1.24.0-1ubuntu11.24.0-2ubuntu11.24.0-2ubuntu21.24.0-2ubuntu31.24.0-2ubuntu4
Show 19 moreShow less
1.24.0-2ubuntu61.24.0-2ubuntu71.24.0-2ubuntu7.11.24.0-2ubuntu7.31.24.0-2ubuntu7.41.24.0-2ubuntu7.51.24.0-2ubuntu7.61.24.0-2ubuntu7.71.24.0-2ubuntu7.81.24.0-2ubuntu7.91.24.0-2ubuntu7.101.24.0-2ubuntu7.111.24.0-2ubuntu7.121.24.0-2ubuntu7.131.24.0-2ubuntu7.141.24.0-2ubuntu7.151.24.0-2ubuntu7.161.24.0-2ubuntu7.171.24.0-2ubuntu7.18
1.24.0-2ubuntu7.19
nginx
Ubuntu:26.10
From an advisory covering 5 CVEs
 before 1.30.4-7ubuntu1.1, plus listed versions
1.28.3-2ubuntu11.30.1-4ubuntu11.30.1-6ubuntu11.30.4-5ubuntu11.30.4-7ubuntu1
1.30.4-7ubuntu1.1
nginx
Ubuntu:26.04:LTS
From an advisory covering 5 CVEs
 before 1.28.3-2ubuntu1.12, plus listed versions
1.28.0-6ubuntu11.28.1-2ubuntu11.28.1-3ubuntu11.28.2-2ubuntu11.28.3-2ubuntu1
Show 11 moreShow less
1.28.3-2ubuntu1.11.28.3-2ubuntu1.21.28.3-2ubuntu1.31.28.3-2ubuntu1.41.28.3-2ubuntu1.51.28.3-2ubuntu1.61.28.3-2ubuntu1.71.28.3-2ubuntu1.81.28.3-2ubuntu1.91.28.3-2ubuntu1.101.28.3-2ubuntu1.11
1.28.3-2ubuntu1.12
nginx
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.31.7-1.1
1.31.7-1.1

History

History
RecordedChangedSources
affected
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-95101 is a medium vulnerability (CVSS 6.9) in F5 Nginx Open Source, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in nginx 1.30.6-r0.

References

Show 33 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open