All vulnerabilities
CVE-2026-95101

NGINX ngx_http_v3_module vulnerability

F5 NGINX PlusWeb servers
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in37.2.0.1Also 37.0.7.1, 1.31.7 and 1 moreCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Text from CVE List

Affected versions 9

  • NGINX Plusaffected: 37.1.0 before 37.2.0.1CVE List
  • NGINX Plusaffected: 37.0.0 before 37.0.7.1CVE List
  • NGINX Plusaffected: R36 and laterCVE List
  • NGINX Plusaffected: R35 and laterCVE List
  • NGINX Plusaffected: R34 and laterCVE List
  • NGINX Plusaffected: R33 and laterCVE List
  • NGINX Open Sourceaffected: 1.31.0 before 1.31.7CVE List
  • NGINX Open Sourceaffected: 1.30.0 before 1.30.6CVE List
  • NGINX Open Sourceaffected: 1.25.0 and laterCVE List

References 1