nghttpx HTTP/2 Upgrade Queue Poisoning — Request Smuggling (nghttp2)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.