CVE-2026-31908

Apache APISIX versions 2.12.0 through 3.15.0 are vulnerable to a critical header injection vulnerability within the forward-auth plugin. The root cause is the improper handling and sanitization of CRLF (\r\n) sequences, which allows unauthenticated attackers to inject malicious HTTP headers via s...