nghttpx HTTP/1.1 Upgrade + Content-Length Queue Poisoning (nghttp2 RCE)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

This rule detects HTTP/1.1 requests containing an Upgrade header (specifically targeting WebSocket upgrades) accompanied by a non-zero Content-Length header. This pattern is characteristic of a request smuggling primitive targeting the nghttpx reverse proxy, where the provided body may be misinterpreted by the backend as a separate, smuggled request due to improper request queue handling.