CVE-2026-95101

Name	CVE-2026-95101
Description	Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6575-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nginx (PTS)	bookworm	1.22.1-9+deb12u9	vulnerable
	bookworm (security)	1.22.1-9+deb12u10	vulnerable
	trixie	1.26.3-3+deb13u7	vulnerable
	trixie (security)	1.26.3-3+deb13u10	fixed
	forky	1.30.4-8	fixed
	sid	1.30.6-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nginx	source	trixie	1.26.3-3+deb13u10		DSA-6575-1
nginx	source	(unstable)	1.30.4-8

https://my.f5.com/manage/s/article/K000162613