REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update

Describe the bug

I updated from version 3.0.14 to 3.0.15 today. Unfortunately, I don't have a ton of helpful info, but I've noticed a few errors that I haven't seen before with REQBODY_ERROR tripping.

Logs and dumps

Here's an example nginx error log (with IP and domain changed).

body.xml:1: parser error : Extra content at the end of the document
2026/05/12 20:51:59 [error] 22751#22751: *430298 [client 123.123.123.123] ModSecurity: Access denied with code 400 (phase 2). Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "53"] [id "200002"] [rev ""] [msg "Failed to parse request body."] [data "XML parsing error: XML: Failed to parse document."] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "example.com"] [uri "/"] [unique_id "177863351988.105338"] [ref "v269,1"], client: 123.123.123.123, server: example.com, request: "GET / HTTP/1.1", host: "example.com"

To Reproduce

Sorry, I don't know how to reproduce this. I've seen this a handful of times in millions of requests.

Server (please complete the following information):

• ModSecurity version (and connector): ModSecurity v3.0.15 with nginx-connector v1.0.4
• WebServer: nginx 1.26
• OS (and distro): Amazon Linux 2

Rule Set (please complete the following information):

• Running any public or commercial rule set? CRS
• What is the version number? 4.26.0

Start by comparing request-body XML parsing between ModSecurity v3.0.14 and v3.0.15, using the REQBODY_ERROR path and the nginx connector context described in the report. Investigate the intermittent “Extra content at the end of the document” log and establish a reproducible request; done should identify the regression or trigger and include a verified fix or regression test.