What is GHSA-g6r5-95cx-mpp9?

GHSA-g6r5-95cx-mpp9 is a security advisory published by GitHub Security Advisories with Medium severity. Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module...

Which CVE IDs does GHSA-g6r5-95cx-mpp9 cover?

GHSA-g6r5-95cx-mpp9 covers the following CVE IDs: CVE-2026-95101. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g6r5-95cx-mpp9?

GHSA-g6r5-95cx-mpp9 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-g6r5-95cx-mpp9MediumCVSS 5.3

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module...

Vendor

GitHub Security Advisories

Published

October 14, 2026

Last Modified

October 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-95101 →

📋 Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with

proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.

Impact

This vulnerability may allow remote attackers to

inject data in the proxied request. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-95101
https://my.f5.com/manage/s/article/K000162613
https://github.com/advisories/GHSA-g6r5-95cx-mpp9