nghttpx HTTP/2 Upgrade Queue Poisoning via Crafted Content-Length (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.