{"id":"CVE-2026-95101","aliases":["ALPINE-CVE-2026-95101","AZL-108449","BELL-CVE-2026-95101","BIT-nginx-2026-95101","BIT-nginx-gateway-2026-95101","DEBIAN-CVE-2026-95101","EUVD-2026-101119","GHSA-g6r5-95cx-mpp9","RHSA-2026:83427","UBUNTU-CVE-2026-95101","USN-8955-1","openSUSE-SU-2026:12143-1"],"status":"published","title":"NGINX ngx_http_v3_module vulnerability","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00346,"percentile":0.28423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-172"],"published":"2026-10-14T14:40:28Z","modified":"2026-11-02T14:16:58Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.30.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.29.0","1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["2.2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.4-8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"nginx","fixed_in":["1.30.4-7ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.25.0"},{"fixed":"1.29.0"},{"introduced":"1.30.0"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"1.25.0"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u10","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6","1.22.1-9+deb12u7","1.22.1-9+deb12u8","1.22.1-9+deb12u9","1.24.0-1","1.24.0-1~exp1","1.24.0-2","1.26.0-1","1.26.0-1~exp1","1.26.0-2","1.26.0-3","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u10"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4","1.26.3-3+deb13u5","1.26.3-3+deb13u6","1.26.3-3+deb13u7","1.26.3-3+deb13u8","1.26.3-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-8"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.7-1.1"}]}],"bundled":5}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000162613","tags":["vendor-advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95101","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g6r5-95cx-mpp9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-95101","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-95101","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95101","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83427","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15176","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97205","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97629","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95101","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83427.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162416","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95101","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162608","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162606","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-95101","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8955-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97629","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97629","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-95101","title":"NGINX ngx_http_v3_module vulnerability","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:28.955Z","modified":"2026-10-15T16:43:46.63Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-101119","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:28Z","modified":"2026-10-15T16:43:46Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:00:11.901066Z"}],"ghsa":[{"id":"GHSA-g6r5-95cx-mpp9","title":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module...","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:32:30Z","modified":"2026-10-14T15:32:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T15:13:26.117603Z"}],"nvd":[{"id":"CVE-2026-95101","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:27.1Z","modified":"2026-10-15T17:17:32.607Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"ALPINE-CVE-2026-95101","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:27.1Z","modified":"2026-10-22T11:30:02.496085765Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-95101","status":"published","published":"2026-10-20T06:09:07.358327Z","modified":"2026-10-22T08:30:06.573518862Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-95101","description":"Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with   proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.  Impact   This vulnerability may allow remote attackers to   inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.       Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:27.1Z","modified":"2026-10-21T17:02:52.202359145Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"RHSA-2026:83427","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-16T10:27:21Z","modified":"2026-10-20T10:43:38.614397927Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-95101","description":"Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-28T20:17:49.089285493Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"AZL-108449","title":"CVE-2026-95101 affecting package nginx for versions less than 1.30.6-1","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:27Z","modified":"2026-11-02T14:16:58.13783768Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BIT-nginx-2026-95101","title":"NGINX ngx_http_v3_module vulnerability","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:03.999Z","modified":"2026-10-21T12:11:26.755824531Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-95101","title":"NGINX ngx_http_v3_module vulnerability","description":"Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:17.86Z","modified":"2026-10-21T12:11:26.755824531Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2026:12143-1","title":"nginx-1.31.7-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-16T17:23:13.464278658Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"USN-8955-1","title":"nginx vulnerabilities","description":"It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.\n(CVE-2026-15176)\n\nIt was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial\nof service, or execute arbitrary code.\n(CVE-2026-93479)\n\nIt was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected\nUbuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use\nthis issue to inject data into proxied requests.\n(CVE-2026-95101)\n\nIt was discovered that nginx incorrectly handled asynchronous file I/O\nin certain configurations with Server Side Includes pages. A remote\nattacker could possibly use this issue to cause nginx to crash,\nresulting in a denial of service, or execute arbitrary code.\n(CVE-2026-97205)\n\nIt was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker\ncould possibly use this issue to forge client SSL sessions and bypass\nclient certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-10-26T15:34:05Z","modified":"2026-10-26T22:46:19.977872622Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}