CVE-2026-31908

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.52% chance of exploitation in the next 30 days, 42th percentile

Published

2026-04-14

Updated

2026-04-16

Proof-of-concept exploits (1)

• MehranTurk/CVE-2026-319081★ · 2026-04-19

References

• CVE Record
• NVD entry

Related

• CVE-2026-31899
• CVE-2026-3192
• CVE-2026-31892
• CVE-2026-3193
• CVE-2026-31886
• CVE-2026-3194