Encoding Error in F5 Networks products - CVE-2026-95101

Vulnerability identifier: #VU155769

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-95101

CWE-ID: CWE-172

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject data into proxied requests.

The vulnerability exists due to an encoding error in the ngx_http_v3_module module when handling HTTP/3 requests with proxy_request_buffering enabled. A remote attacker can send an HTTP/3 request to inject data into proxied requests.

This is a data plane issue only; there is no control plane exposure.

NGINX Gateway Fabric
F5 DoS for NGINX
F5 WAF for NGINX
NGINX Open Source
NGINX Instance Manager
NGINX Ingress Controller
NGINX Plus

Install security update from vendor's website.

NGINX Gateway Fabric - update to 2.8.0
NGINX Open Source - addressed in versions 1.30.6, 1.31.7
NGINX Instance Manager - update to 2.24.0
NGINX Ingress Controller - update to 5.7.0
F5 DoS for NGINX - update to 4.11.0
F5 WAF for NGINX - addressed in versions 5.14.2, 5.16.0
NGINX Plus - addressed in versions 37.0.7.1, 37.2.0.1

• https://my.f5.com/manage/s/article/K000162613

• Multiple vulnerabilities in nginx