Zero Radar
← feed
HighVulnerabilityCVE-2026-95101updated 26 Oct 2026, 17:26 UTC

nginx web server: HTTP/3 request data can be injected into proxied requests

A flaw in how nginx handles some HTTP/3 requests could let an outside attacker slip extra data into requests that nginx forwards to backend servers. This can cause the backend to act on requests it should never have received.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdated nginx packages published in Debian DSA-6575-1 and Ubuntu USN-8955-1; specific fixed version numbers not stated in the material. · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends HTTP/3Crafted fragmented frames sent to nginx
  2. 2nginx handles framesUnknown frames treated as body data
  3. 3Request is proxiedForwarded with injected content
  4. 4Backend receives itBackend sees request it should not
  5. ResultRequests injected into backend servers

What happened

CVE-2026-95101: fragmented unknown HTTP/3 frames are treated as request body data when proxy_request_buffering is enabled, allowing request injection into backends or bypass of request body size limits.

Why it is dangerous: Attackers could send crafted requests that reach backend applications as if they were legitimate, and could bypass body size limits. Sites that use nginx as a reverse proxy in front of applications are at risk.

Are you affected?

You are affected if you run nginx with HTTP/3 enabled and proxy_request_buffering on, on Ubuntu 26.04 LTS or Ubuntu 26.10 for the Ubuntu-listed issue, or a Debian trixie nginx package.

nginx packages in Debian (DSA-6575-1, trixie) and Ubuntu 26.04 LTS and 26.10 (USN-8955-1); exact vulnerable versions not stated in the material.

What to do

  1. Update nginx to the fixed package from Debian DSA-6575-1 or Ubuntu USN-8955-1
  2. Restart nginx after the update so the fix takes effect
  3. If you cannot update right away, review whether HTTP/3 and proxy_request_buffering are needed

Timeline

  1. 21 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 21 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  3. 26 Oct 2026, 17:26 UTC
    Ubuntu Security reported on it · Ubuntu Security

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-95101
EPSS
0.3% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 17:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

nginx web server: HTTP/3 request data can be injected into proxied requests · Zero Radar