Loading vulnerability…
HTTP/3 Request Body Injection in NGINX
CVE-2026-95101 is an HTTP/3 request-body handling vulnerability in ngx_http_v3_module in NGINX Open Source and NGINX Plus. Incorrect handling of unknown HTTP/3 frames fragmented across reads can cause remaining frame bytes to be interpreted as request-body data rather than skipped. With HTTP/3 enabled and proxy_request_buffering set to on, an unauthenticated remote attacker may inject data into requests forwarded to upstream servers. The flaw can also allow request bodies to exceed the client_max_body_size limit. The affected HTTP/3 code was introduced in NGINX 1.25.0; upstream fixes are available in stable version 1.30.6 and mainline version 1.31.7. Exposure is limited to the data plane, with no control-plane exposure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers may alter the integrity of proxied requests by introducing bytes that NGINX incorrectly treats as request-body data. This can enable backend request injection and bypass of the configured client_max_body_size limit. The vulnerability-specific CVSS assessments identify low integrity impact and no confidentiality or availability impact; arbitrary code execution is not an established consequence of this flaw.
If you can’t patch tonight, do this now.
Set proxy_request_buffering off in affected proxy configurations. Alternatively, disable HTTP/3 on exposed listeners to avoid the vulnerable parsing path. Validate and apply configuration changes, and use these workarounds pending installation of a fixed release.
Patch, then assume compromise.
Upgrade NGINX Open Source to stable version 1.30.6, mainline version 1.31.7, or a later fixed release. Upgrade NGINX Plus to 37.0.7.1 or 37.2.0.1, as appropriate for the release branch, or a later fixed release; migrate older affected branches to a supported fixed release. Vendor-patched distribution packages are also suitable: Debian 13 fixes are available in 1.26.3-3+deb13u10, Ubuntu 26.04 LTS fixes in 1.28.3-2ubuntu1.12, and Ubuntu 26.10 fixes in 1.30.4-7ubuntu1.1. Update embedded NGINX components and container images separately where necessary, and ensure active workers are running the corrected binary.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.