CVE-2026-95101: NGINX ngx_http_v3_module Data Injection Vulnerability
Summary
CVE-2026-95101: NGINX ngx_http_v3_module vulnerability. Affects nginx across 3 version ranges.
>= 1.25.0, < 1.29.0
>= 1.30.0, < 1.30.6
>= 1.31.0, < 1.31.7
Fixed in 1.29.0, 1.30.6 or 1.31.7, depending on the release line you run. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-95101 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server widely used for serving static content, load balancing, and as a gateway for HTTP/3 connections. The ngx_http_v3_module is specifically designed to handle HTTP/3 traffic, which is the latest version of the HTTP protocol, offering improved performance and reduced latency. However, a vulnerability has been identified in this module that could allow unauthorized data injection in proxied requests.
Vulnerability Detail
The vulnerability in the ngx_http_v3_module arises when the proxy_request_buffering directive is enabled while using HTTP/3. This configuration may allow an unauthenticated attacker to inject arbitrary data into the proxied request, potentially leading to unauthorized access or manipulation of data. The issue is classified as a data plane problem, meaning it affects the data being transmitted rather than the control mechanisms of the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.25.0, < 1.29.01.29.0 -
>= 1.30.0, < 1.30.61.30.6 -
>= 1.31.0, < 1.31.71.31.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the proxy_request_buffering directive in your NGINX configuration to prevent data injection. Modify your NGINX configuration file (usually located at /etc/nginx/nginx.conf) and set the directive as follows:
proxy_request_buffering off;
After making this change, restart NGINX to apply the new configuration:
sudo systemctl restart nginx
Conclusion
The CVE-2026-95101 vulnerability in the NGINX ngx_http_v3_module poses a significant risk by allowing unauthorized data injection in proxied requests. It is crucial to update to the patched versions or implement the recommended workarounds to mitigate potential threats. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-95101 is a vulnerability in the NGINX ngx_http_v3_module that allows unauthorized data injection in proxied requests when using HTTP/3 with proxy_request_buffering enabled.
You can check your NGINX version by running the command nginx -v. If your version is between 1.25.0 and 1.31.7, it may be affected by this vulnerability.
An attacker could exploit this vulnerability to inject malicious data into proxied requests, potentially leading to unauthorized access or data manipulation.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If an immediate update is not possible, consider disabling the proxy_request_buffering directive as a temporary workaround until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
