CVE-2026-95101

NGINX is the traffic-director software many websites use to route visitor requests to the right backend server. This bug is like a flaw in a mail sorting machine that, under a specific setting, lets someone slip extra content into a letter before it's forwarded — potentially altering what the backend server receives, without the attacker needing a login.

This matters to you if you run NGINX or NGINX Plus as a reverse proxy or load balancer. It only applies if you've enabled HTTP/3 support together with the proxy_request_buffering option turned on — if you don't use HTTP/3 proxying, you are not exposed.

This is rated urgent: the flaw is remotely reachable by anyone on the internet without needing a password, and it affects a very widely deployed piece of infrastructure software, so it should be treated as a priority fix rather than something to defer. There's no evidence yet of attackers actively exploiting it and no public exploit code, but given the exposure and growing press attention, act now rather than wait for that to change.

Confirm exposure by checking your nginx.conf for http3 listen directives combined with proxy_request_buffering on (or its default, which is on unless explicitly disabled). If immediate patching isn't possible, apply the documented workaround — set proxy_request_buffering off; in the relevant server/location block — which fully mitigates the data-plane risk described (https://nginx.org/en/docs/http/ngx_http_proxy_module.html). For permanent remediation, upgrade NGINX Open Source to 1.31.7 (mainline) or 1.30.6 (stable), and NGINX Plus customers to 37.2.0.1 or 37.0.7.1 depending on your release track; versions that have reached End of Technical Support are not covered by fixes and should be upgraded off entirely. No CISA KEV listing exists and there's no known due date. There is no control-plane exposure — this is isolated to the data plane (proxied request handling). Monitor nginx release notes and your vendor's security advisories for any escalation in exploitation status, and re-test HTTP/3 proxy behavior after upgrading to confirm the workaround (if used) is no longer needed.

Severity is CVSS 3.1 5.3 (Medium), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N — network-exploitable, no privileges or user interaction, low-complexity, impacting integrity only (no confidentiality or availability loss). Weakness class is CWE-172 (Encoding Error), manifesting in the HTTP/3 module (ngx_http_v3_module) when proxy_request_buffering is enabled, allowing injection into the proxied request stream. Not in CISA KEV, no public exploit code identified, and EPSS places predicted exploitation likelihood in a low percentile with a flat trend. Press coverage is rising (roundup-style, referencing actor 'Armory Castle') but this reflects attention, not confirmed in-the-wild exploitation. Fixes exist for both NGINX Open Source (1.31.7, 1.30.6) and NGINX Plus (37.2.0.1, 37.0.7.1); a configuration-level workaround (disabling proxy_request_buffering) fully mitigates the issue pending upgrade.