CVE-2026-31908

Apache APISIX (forward-auth plugin) is affected by a header injection vulnerability (CVE-2026-31908) tracked across multiple feeds. Affects versions 2.12.0 through 3.15.0; exploitation arises from improper sanitization of CRLF sequences in the forward-auth plugin, enabling injection of HTTP heade...

CVE-2026-39998

CVE-2026-39998 describes an identity-header spoofing issue in Apache APISIX caused by improper input validation in the forward-auth plugin. Affects APISIX releases from 2.12.0 through 3.16.0. Exploitation could enable an attacker to spoof identity headers due to configuration in forward-auth. The...

CVE-2026-74848

Apache APISIX is vulnerable to an HTTP Request/Response Smuggling flaw in serverless-plugin routes , allowing an unauthenticated network attacker to cause other clients to receive attacker-chosen or cross-user responses. The issue affects versions 2.12.0 through 3.17.0 and is fixed in version 3.1...