At a glance
- Nginx disclosed CVE-2026-95101, an HTTP/3 request body injection vulnerability.
- Nginx 1.25.0–1.31.6 is affected; 1.31.7+ and 1.30.6+ are unaffected.
- The reported severity is medium.
- Check the version and plan an upgrade to a confirmed unaffected branch.
Nginx warns of HTTP/3 request body injection in CVE-2026-95101: check versions and plan an upgrade
Nginx disclosed CVE-2026-95101, an HTTP/3 request body injection vulnerability rated medium severity. Versions 1.25.0–1.31.6 are affected; administrators should check their Nginx version and plan an upgrade to the confirmed unaffected 1.31.7+ or 1.30.6+ branches.
In this article
Nginx, a web server and reverse proxy that supports HTTP/3, disclosed vulnerability CVE-2026-95101. See the Nginx security advisory for the source information.
Overview and technical details
The vulnerability is described as HTTP/3 request body injection and is rated medium severity. The advisory provides no further details about the exploitation mechanism or consequences.
| Field | Details |
|---|---|
| Product | Nginx |
| Vulnerability ID | CVE-2026-95101 |
| Issue | HTTP/3 request body injection |
| Severity | Medium |
Affected systems
Nginx versions 1.25.0–1.31.6 are affected. Versions 1.31.7+ and 1.30.6+ are confirmed unaffected; these are separate version branches.
| Product | Affected versions | Unaffected versions |
|---|---|---|
| Nginx | 1.25.0–1.31.6 | 1.31.7+ |
| Nginx | 1.25.0–1.31.6 | 1.30.6+ |
System checks
Check the installed Nginx version:
nginx -vCompare the result: versions in the 1.25.0–1.31.6 range are affected; 1.31.7+ and 1.30.6+ are confirmed unaffected.
Remediation and mitigation
Administrators should plan an upgrade to a confirmed unaffected branch: 1.31.7+ or 1.30.6+. The source record provides no detailed patch instructions or workaround, so no upgrade command or alternative mitigation is included here.
References
Related articles
Nginx discloses CVE-2026-93479: check versions and upgrade affected branches
Nginx disclosed buffer overflow CVE-2026-93479 during script evaluation, rated medium severity. Nginx 1.31.2–1.31.6 and 1.30.0–1.30.5 are affected; check the installed version and upgrade to 1.31.7+ or 1.30.6+, respectively.
UnrealIRCd: CISA confirms active exploitation of CVE-2026-114713
CISA confirms CVE-2026-114713 in UnrealIRCd is being exploited in the wild. A user on a network with at least two linked servers can inject server-to-server commands executed with server privileges. Prioritize mitigations under CISA guidance before the KEV deadline of 2026-11-16.
Node.js releases security updates for the 22.x, 24.x, and 26.x lines
Node.js has released security updates for the 22.x, 24.x, and 26.x lines, fixing HTTP/2, HTTPS, and TLS flaws that may disrupt servers, expose memory or data, or bypass certificate authentication. Check your version and upgrade to the corresponding security release.