Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

CVE-2026-95101: Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-95101 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
6.9 (F5), 5.3 (Red Hat)
Weakness
CWE-444
Fixed releases
  • F5: 37.2.0.1, 37.0.7.1, 1.31.7, 1.30.6
  • Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427
Vendor advisories
2 from F5, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-95101; bulletin-wide values are not repeated here.

Is CVE-2026-95101 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-95101 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-95101?

Upgrade to a fixed release named by the vendor:

  • F5: 37.2.0.1, 37.0.7.1, 1.31.7, 1.30.6
  • Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427

Vendor advisory comparison

F5

1 advisory
  • Advisory severityMedium6.9

    Medium [CVE-2026-95101] Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

    CVE-2026-95101Source published Source updated

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Affected products in this advisory
    • NGINX Plus
    • NGINX Open Source
    Source-reported affected versions
    • NGINX Plus 37.1.0 before 37.2.0.1
    • NGINX Plus 37.0.0 before 37.0.7.1
    • NGINX Plus R36
    • NGINX Plus R35

    5 more entries in the full advisory.

    Source-reported fixed versions
    • 37.2.0.1
    • 37.0.7.1
    • 1.31.7
    • 1.30.6
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-95101] Data injection in proxied requests via HTTP/3 request buffering

    CVE-2026-95101Source published Source updated

    Data injection in proxied requests via HTTP/3 request buffering. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:83427 with package nginx-main-1.30.6-1.hum1. Affected product named by the advisory: Red Hat Hardened Images.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • nginx-main-1.30.6-1.hum1
    • RHSA-2026:83427
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features