Read the docs
TI-2026-74060 Aliases CVE-2026-95101GHSA-g6r5-95cx-mpp9

Data injection in NGINX HTTP/3 proxied requests

Priority LOW 36CWE-172Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

NGINX Plus 37.0.0 before 37.0.7.1 and 37.1.0 before 37.2.0.1, and NGINX Open Source 1.30.0 before 1.30.6 and 1.31.0 before 1.31.7, are affected in the ngx_http_v3_module module. An encoding error (CWE-172) lets an unauthenticated remote attacker inject data into proxied requests when HTTP/3 is used with proxy_request_buffering on. The flaw affects the data plane only.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Partial NGINX Plus (F5): 37.2.0.1, 37.0.7.1NGINX Open Source (F5): 1.31.7, 1.30.6Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Plus37.1.0 to before 37.2.0.1; 37.0.0 to before 37.0.7.1; R36 and later; R35 and later; R34 and later; R33 and later37.2.0.1, 37.0.7.1Patch availableCNA
F5NGINX Open Source1.31.0 to before 1.31.7; 1.30.0 to before 1.30.6; 1.25.0 and later1.31.7, 1.30.6Patch availableCNA
  • NGINX Plus VendorF5 Affected 37.1.0 to before 37.2.0.1; 37.0.0 to before 37.0.7.1; R36 and later; R35 and later; R34 and later; R33 and later Fixed in 37.2.0.1, 37.0.7.1 Patch available CNA
  • NGINX Open Source VendorF5 Affected 1.31.0 to before 1.31.7; 1.30.0 to before 1.30.6; 1.25.0 and later Fixed in 1.31.7, 1.30.6 Patch available CNA

Remediation

Upgrade NGINX Plus to 37.2.0.1 or 37.0.7.1 and NGINX Open Source to 1.31.7 or 1.30.6. Red Hat fixes Red Hat Hardened Images in RHSA-2026:83427, and Red Hat Enterprise Linux 9 and 10 have no fix plan. The sources list no fixed version for NGINX Open Source 1.25.0 and later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Plus (F5) Fixed in 37.2.0.1, 37.0.7.1
  • Fix · CNA NGINX Open Source (F5) Fixed in 1.31.7, 1.30.6

Red Hat 1 advisory

  • RHSA-2026:83427 Released 2026-10-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nginx-1.30.6-1.hum1@aarch64, nginx-1.30.6-1.hum1@s390x, nginx-1.30.6-1.hum1@src +34

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Open Source 1.30.6, 1.31.7

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-74056 Heap buffer overflow in NGINX map directive regex matchingPriority MEDIUM 44
    • TI-2026-73990 Heap buffer overflow in NGINX alias and rewrite handlingPriority MEDIUM 44
    • TI-2026-74062 Use-after-free in NGINX ngx_http_core_module can crash workersPriority MEDIUM 43
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:83427
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-95101
  2. 2026-10-14 Alias added: GHSA-g6r5-95cx-mpp9
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: MEDIUM → LOW
  5. 2026-10-20 Fix available: RHSA-2026:83427 · Red Hat
  6. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-10-20 CVSS score added · Red Hat
  8. 2026-10-26 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences