CVE-2026-95101: NGINX Plus 37.1.0 to before 37.2.0.1, 37.0.0 to before 37.0.7.1, R36 to before *, R35 to before *, R34 to before *…

Affected technology

NGINX Plus · 37.1.0 to before 37.2.0.1, 37.0.0 to before 37.0.7.1, R36 to before *, R35 to before *, R34 to before *, R33 to before *
F5

NGINX Open Source · 1.31.0 to before 1.31.7, 1.30.0 to before 1.30.6, 1.25.0 to before *
F5

Component: ngx_http_v3_module

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says when using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.