CVE-2026-95101: NGINX Gateway HTTP/3 Module Vulnerability
Summary
CVE-2026-95101: NGINX ngx_http_v3_module vulnerability. Affects nginx-gateway versions >= 1.25.0, < 2.2.1. Fixed in 2.2.1. How to fix ↓
Also tracked for
- nginx · Bitnami
The same CVE-2026-95101 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server known for its ability to handle high traffic loads efficiently. The NGINX Gateway, particularly with the ngx_http_v3_module, enables support for HTTP/3, the latest version of the HTTP protocol. This module is designed to improve web performance and security. However, a vulnerability has been identified that could allow unauthorized data injection in proxied requests when certain configurations are used.
Vulnerability Detail
The vulnerability in the ngx_http_v3_module arises when the 'proxy_request_buffering' directive is enabled. An unauthenticated attacker can exploit this flaw to inject malicious data into proxied requests. This poses a significant risk as it can lead to unauthorized access or manipulation of data being transmitted through the server. The issue is classified as a data plane problem, meaning it affects the data being processed rather than the control mechanisms of the server.
How To Fix
Minimum fixed version
2.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'proxy_request_buffering' directive in your NGINX configuration file. This can be done by adding the following line to your configuration: 'proxy_request_buffering off;'. However, please note that this may affect the performance and behavior of your application.
Conclusion
The CVE-2026-95101 vulnerability in the NGINX Gateway's HTTP/3 module poses a significant risk of unauthorized data injection in proxied requests. It is crucial to update to the patched version 2.2.1 or later to mitigate this risk. For those unable to upgrade immediately, a temporary workaround is available, though it may affect application performance.
See every vulnerability recorded for nginx-gateway →
FAQ
CVE-2026-95101 is a vulnerability in the NGINX Gateway's HTTP/3 module that allows unauthorized data injection in proxied requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access or manipulation of data in proxied requests, posing a security risk to your application.
Yes, the vulnerability has been patched in version 2.2.1 of the NGINX Gateway. It is recommended to upgrade to this version or later.
If an immediate upgrade is not possible, consider disabling the 'proxy_request_buffering' directive as a temporary workaround, but be aware of the potential performance impacts.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx-gateway.
