Security1 hOctober 27, 2026, 16:41

NGINX fixes CVE-2026-95101 HTTP/3 request smuggling flaw

NGINX 1.30.6 and 1.31.7 patch CVE-2026-95101, rated 6.9, where a shared counter for skipped unknown QUIC frames let an HTTP/3 client inject extra bytes into proxied requests or exceed client_max_body_size. Versions 1.25.0 through 1.31.6 are affected when HTTP/3 is enabled and proxy_request_buffering is left on.

DEV Community

Open source

NGINX fixes CVE-2026-95101 HTTP/3 request smuggling flaw

CVE-2026-95101 is rated 6.9 by F5
NGINX 1.25.0–1.31.6 affected with HTTP/3 enabled
Requires a quic listen directive and proxy_request_buffering on
Workaround: disable buffering or turn off HTTP/3

#NGINX#F5

CVE-2026-29057: HTTP request smuggling via Next.js rewrites

Security

Five NGINX flaws: 313M fingerprinted hosts, but zero CVE matches

Security

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

Security

NGINX fixes CVE-2026-95101 HTTP/3 request smuggling flaw

CVE-2026-29057: HTTP request smuggling via Next.js rewrites

Five NGINX flaws: 313M fingerprinted hosts, but zero CVE matches

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

ZoomEye Finds 1,577,590 F5 BIG-IP Matches After CVE-2026-94127 KEV Entry