CVE-2026-95101

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://my.f5.com/manage/s/article/K000162613

Weakness type (CWE)

CWE-172

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse1 post

Rıdvan Yağlı@ridvanyagli1d
🚨 NGINX 5 güvenlik açığını yamaladı: Buffer Overflow, Use-After-Free ve HTTP/3 Request Injection! NGINX 1.31.7 ile giderilen 5 CVE, belirli yapılandırmalarda worker process crash ve olası code execution riskleri barındırıyor. 🔴 Öne çıkanlar: CVE-2026-15176 — alias + rewrite kaynaklı Buffer Overflow CVE-2026-93479 — Variable evaluation sırasında Buffer Overflow CVE-2026-95101 — HTTP/3 üzerinden body limit bypass ve request injection CVE-2026-97629 — TLS session ticket güvenliği CVE-2026-97205 — AIO + SSI kaynaklı Use-After-Free ⚠️ Özellikle reverse proxy ve HTTP/3 kullanan sistemlerde güncelleme öncelikli olarak yapılmalı. Ancak önerilen mutlaka en yeni sürüme güncellemektir. Security Advisory: https://nginx.org/en/security_advisories.html Changelog: https://nginx.org/en/CHANGES
00001217
2.5K followersView on X

Explore more

Back to dashboard