CVE-2026-95101 in NGINX Plus
Summary
by MITRE • 10/15/2026
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.
Impact
This vulnerability may allow remote attackers to
inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The ngx_http_v3_module within NGINX Plus and NGINX Open Source contains a critical vulnerability that affects the handling of HTTP/3 traffic when specific buffering configurations are active. This flaw is specifically triggered by the interaction between the HTTP/3 protocol implementation and the proxy_request_buffering directive. When this directive is enabled, which allows NGINX to buffer requests sent to upstream servers before forwarding them, an unauthenticated attacker can exploit a logic error in how data frames are processed during the multiplexed nature of QUIC-based connections. The vulnerability stems from improper validation or boundary checking when constructing the proxied request body, allowing malicious actors to inject arbitrary data into the stream that is being forwarded to backend services. This represents a significant deviation from expected protocol behavior and undermines the integrity of the proxying mechanism.
From an operational perspective, this vulnerability poses a severe risk to application security because it enables remote code execution scenarios or unauthorized actions depending on how the upstream server processes the injected data. Since there is no control plane exposure, the attack surface is strictly limited to the data plane, meaning attackers do not need administrative access to exploit this flaw but must be able to send HTTP/3 requests directly to the NGINX instance. The ability to inject data into proxied requests can lead to SQL injection, cross-site scripting if the backend renders user input, or more sophisticated attacks such as header smuggling or request splitting if the injected content manipulates control structures within the application layer. This effectively bypasses any security controls that rely on trusting the integrity of incoming client requests processed by NGINX before they reach the origin server.
This vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves injecting malicious content into data streams destined for downstream systems. In terms of attack tactics, this falls under MITRE ATT&CK technique T1505 Server Software Components, specifically relating to the exploitation of web server modules or plugins that handle request processing and forwarding. The lack of authentication requirements makes this a high-severity issue for any public-facing service using HTTP/3 with proxy buffering enabled. Attackers can leverage standard HTTP/3 clients to craft malformed requests that trigger the buffer handling flaw, potentially leading to data exfiltration, privilege escalation on backend systems, or denial of service if the injection causes upstream processing failures.
Mitigation strategies should focus primarily on updating NGINX software versions where this issue has been patched by the development team. Until an update is available, administrators can mitigate the risk by disabling proxy_request_buffering for locations that handle untrusted input over HTTP/3 connections. Alternatively, if possible, restricting access to only trusted clients or terminating HTTP/3 at a different layer before it reaches NGINX instances with this module configuration can reduce exposure. It is also advisable to monitor logs for anomalous patterns in QUIC traffic and ensure that upstream servers have their own input validation mechanisms as a defense-in-depth measure. Organizations should verify which software versions are supported, noting that End of Technical Support releases will not receive security patches for this vulnerability.