CVE-2026-95101 vulnerability in F5 Networks Products
Published on October 14, 2026
NGINX ngx_http_v3_module vulnerability
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.
Impact
This vulnerability may allow remote attackers to
inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability Analysis
CVE-2026-95101 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Encoding Error
The software does not properly encode or decode the data, resulting in unexpected values.
Products Associated with CVE-2026-95101
stack.watch emails you whenever new vulnerabilities are published in F5 Networks Nginx Plus or F5 Networks Nginx Open Source. Just hit a watch button to start following.
Affected Versions
F5 NGINX Plus:- Version 37.1.0 and below 37.2.0.1 is affected.
- Version 37.0.0 and below 37.0.7.1 is affected.
- Version R36 and below * is affected.
- Version R35 and below * is affected.
- Version R34 and below * is affected.
- Version R33 and below * is affected.
- Version 1.31.0 and below 1.31.7 is affected.
- Version 1.30.0 and below 1.30.6 is affected.
- Version 1.25.0 and below * is affected.