Executive brief
A vulnerability exists in the nghttpx proxy, a component of the nghttp2 library used to manage web traffic. An attacker can send a specially crafted request that tricks the proxy and the backend server into disagreeing about where one request ends and the next begins. This allows the attacker to 'smuggle' a hidden request that can result in another user receiving the attacker's data instead of their own, potentially leading to account confusion or the delivery of malicious content to legitimate users.
Technical details
The nghttpx proxy fails to properly handle HTTP/1.1 Upgrade requests that also include a Content-Length header and a message body. When forwarding such requests to a backend via reusable keep-alive connections, nghttpx passes the Content-Length verbatim while re-adding Upgrade headers. If the backend prioritizes the Upgrade header over the Content-Length, it may interpret the subsequent body bytes as a new, separate HTTP request. This leads to request smuggling and cross-client response-queue poisoning, where a victim's request is matched with the attacker's smuggled response. The vulnerability is fixed in commit ab28105c4a0197da24f8bfc414bc116055249e1e.
Affected products
- nghttp2 nghttp2 (nghttpx) <= 1.69.0
Timeline
- 2026-05-22: patched: Fix committed to master branch
- 2026-06-28: advisory: NVD publication date