nghttpx HTTP/2 Upgrade Queue Poisoning – h2c Upgrade with Content-Length Smuggling
Detects potential HTTP Request Smuggling attempts targeting the nghttpx reverse proxy by monitoring for HTTP/1.1 'Upgrade: h2c' requests that include a 'Content-Length' header, or traffic containing known PoC-specific payloads, poisoned paths, or specific nghttp2 version strings that indicate exploitation activity.
Microsoft Sentinel (KQL)
