CVE-2026-58055: nghttp2 nghttpx HTTP Request Smuggling via Upgrade and Content-Length

Technical summary

The vulnerability exists in nghttpx's handling of HTTP/1.1 Upgrade requests on reusable keep-alive backend connections. When an Upgrade request arrives with both a Content-Length header and a body, nghttpx forwards it while re-injecting the Upgrade and Connection headers but preserving the Content-Length value verbatim. This creates an ambiguous message format: the presence of both Content-Length and Upgrade semantics can be resolved differently by the backend depending on its parsing logic. An attacker can exploit this ambiguity to perform HTTP request smuggling—injecting unintended requests into the stream—or response-queue poisoning, where responses intended for one authenticated client are delivered to another. The attack requires non-standard backend behavior and network conditions that allow request sequencing control, making exploitation difficult but possible in certain configurations.

Business impact

Organizations using nghttpx as an HTTP/2 to HTTP/1.1 proxy may face cross-client response poisoning, where sensitive data or session credentials belonging to one user are leaked to another user. This breaks confidentiality and can enable session hijacking or privilege escalation if the backend application trusts response ordering. The attack also enables HTTP request smuggling, allowing attackers to bypass security controls, access restricted endpoints, or manipulate application state. The blast radius is typically limited to clients downstream of the affected proxy, but in multi-tenant SaaS or shared infrastructure scenarios, impact can be widespread.

Affected systems

nghttp2 versions through 1.69.0 are affected when deployed as the nghttpx reverse proxy or forwarding proxy. The vulnerability requires: (1) nghttpx receiving an HTTP/1.1 Upgrade request with Content-Length and body; (2) forwarding to a backend over a persistent (keep-alive) connection; (3) a backend that resolves the ambiguity in the attacker's favor. Configurations using nghttpx for HTTP/2 to HTTP/1.1 protocol translation, particularly in API gateways or load-balancer roles, are most exposed. Systems using nghttp2 as a library for other purposes (not nghttpx) are not affected.

Exploitability

Exploitation requires network-level control to craft and sequence HTTP/1.1 Upgrade requests with Content-Length bodies, plus knowledge of the backend's parsing behavior. The Upgrade mechanism is uncommon in modern APIs (more common in legacy or specialized protocols like WebSocket), reducing the frequency of exploitable request patterns. Attack difficulty is rated high because the attacker must align three factors: crafting an ambiguous request, predicting backend interpretation, and controlling request timing on reusable connections. No public exploit code or active exploitation has been documented. The CVSS score of 5.4 (MEDIUM) reflects the requirement for specific network conditions and non-standard backend behavior, though impact severity is notable when conditions align.

Remediation

Upgrade to nghttp2 version 1.70.0 or later, which corrects the forwarding logic for Upgrade requests with Content-Length to prevent ambiguous messages. After patching, validate that nghttpx correctly rejects or normalizes such requests. Additionally, review backend HTTP/1.1 server configurations to ensure they follow RFC 7230 strictly: Content-Length must take precedence over chunked encoding, and Upgrade semantics should not override message-length disambiguation. Monitor for suspicious Upgrade request patterns in access logs.

Patch guidance

Apply the upgrade to nghttp2 version 1.70.0 or later. Verify the patch version in your installed release notes or via `nghttpx --version`. If you compile nghttp2 from source, rebuild from the patched source tree. Test the upgrade in a staging environment with your real backend configurations to ensure no regressions in Upgrade request handling (e.g., WebSocket proxying). Restart all nghttpx instances gracefully to activate the patched code.

Detection guidance

Hunt for HTTP/1.1 Upgrade requests that include both Content-Length and a message body in proxy logs. Check for unusual patterns where Upgrade requests are forwarded to backends with persistent connections. Monitor backend servers for signs of request smuggling: unexpected requests appearing in application logs without corresponding proxy records, or responses delivered out of order. Implement strict Content-Length validation on backend servers and log any ambiguous message scenarios. Use network sensors to detect request-response timing anomalies on backend connections.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. While the CVSS score is MEDIUM and no active KEV exploitation is reported, the potential for cross-client data leakage and session hijacking justifies prioritization for systems serving sensitive data or multi-tenant workloads. However, the requirement for specific network conditions, uncommon Upgrade request patterns, and backend-specific parsing behavior means risk is lower for typical REST API deployments. Prioritize patches for nghttpx instances in front of legacy or specialized backends that handle WebSocket or other Upgrade-based protocols.

Risk score, explained

CVSS 5.4 (MEDIUM) reflects: moderate impact (confidentiality and integrity of cross-client responses compromised), high attack complexity (requires aligned network conditions, backend parsing quirks, and request sequencing control), network accessibility, and no privilege requirement. The severity is neither critical nor low because exploitation is possible but conditional. The score appropriately captures that while the flaw is real and can leak data, real-world exploitation is constrained by the rarity of Upgrade requests and the specificity of backend implementations.

Frequently asked questions