CVE-2026-95101

A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity.

A flaw was found in NGINX within the HTTP/3 module (ngx_http_v3_module). When HTTP/3 is configured and proxy_request_buffering is active, an unauthenticated remote attacker can inject arbitrary data into proxied client requests. An attacker can exploit this condition to manipulate request payloads forwarded to upstream backend services, compromising data integrity at the proxy layer. Default SELinux confinement (httpd_t) and unprivileged worker execution prevent privilege escalation or container escape, restricting the impact entirely to the proxied HTTP data stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable HTTP/3 by removing the quic parameter from all listen directives, or configure proxy_request_buffering off; within the relevant http, server, or location blocks.