CVE-2026-95101

Medium

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

SeverityMedium

CVSS5.3

Exploit probability—

Product

Microsoft Azl3 Nginx

PublishedOct 14, 2026

First seenOct 14, 2026

Weakness typeCWE-172CWE-172

How to fix

Vendor advisories

my.f5.com/manage/s/article/K000162613

Affected products

Product	Affected versions	Fixed in
microsoft azl3_nginx_1.30.4-1	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.