nghttpx HTTP Upgrade Queue Poisoning Request Smuggling Detection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects signs of HTTP request smuggling attempts targeting nghttpx or similar proxies. The rule monitors for a specific poisoning precondition where an HTTP/1.1 Upgrade request contains both an 'Upgrade' header and a 'Content-Length' header, which can be leveraged to desynchronize the connection and smuggle subsequent requests (e.g., GET /poisoned).