NGINX CVE-2026-95101

Exploitation requires the proxy to be running HTTP/3 (the ngx_http_v3_module, i.e. a QUIC 'listen ... quic' listener) AND the proxy_request_buffering on directive active on the proxied location. Both conditions must hold simultaneously; HTTP/3 is not enabled in default nginx builds/configurations, which is the primary limiting factor and sharply narrows the exposed population despite the unauthenticated network vector. Impact is limited to injecting data into the request forwarded to the upstream (integrity only); there is no confidentiality loss, no availability loss, and F5 states no control-plane exposure. Instances serving only HTTP/1.1 or HTTP/2, or with request buffering off, are not affected.

Signals point to a moderate, not critical, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which sounds alarming, but the impact metrics sharply constrain it: VC:N/VI:L/VA:N means confidentiality and availability are untouched and only a LOW integrity effect (data injection into the proxied request) applies, yielding a 6.9 Medium score. F5 explicitly scopes this to the data plane with no control-plane exposure, and sets all subsequent-system metrics (SC/SI/SA) to N, so no scope change onto another system is claimed. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data - so this is 'no public exploit identified at time of analysis,' and the unauthenticated network reach is heavily gated by a non-default precondition (HTTP/3 via ngx_http_v3_module must be enabled). Net: a real but bounded data-plane integrity issue, not a high-urgency RCE; the headline 'unauthenticated/network' attributes overstate real-world exposure because HTTP/3 is not enabled in most nginx deployments. Note: CWE-172 (encoding error) and the 'inject data in the proxied request' wording are consistent with an HTTP/3 request-handling/smuggling-style defect rather than code execution, despite the 'Code Injection' tag.

An attacker reaches an internet-facing nginx/NGINX Plus instance that has HTTP/3 enabled and proxy_request_buffering on, then sends crafted HTTP/3 request traffic that is improperly decoded and relayed to the upstream. The malformed framing lets the attacker inject attacker-controlled data into the request forwarded to the backend, potentially poisoning or smuggling content to the proxied application. No authentication is required, but no public exploit code is identified at time of analysis.