nghttp2 nghttpx HTTP Upgrade Queue Poisoning — Request Smuggling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects potential HTTP Request Smuggling via nghttpx, where an HTTP/1.1 Upgrade request containing a Content-Length header is followed by a subsequent request within a short time window on the same backend connection. This pattern indicates a potential attempt to route poisoned responses to a victim client reusing the keep-alive connection.