CVE-2026-95101

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-172

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-951029.4WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can eCVE-2026-951047.5Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-sCVE-2026-951058.2Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows aCVE-2026-951069.1Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resoCVE-2026-951077.0A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header toCVE-2026-951086.8One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks forCVE-2026-951098.5The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module ManagerCVE-2026-95116.3A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of tCVE-2026-951114.8A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's bufferCVE-2026-951126.5When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per MCVE-2026-951147.5libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker CVE-2026-951157.5Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
CVE-2026-95101: Medium severity, CVSS 5.3 | Vulnix