CVE-2026-58055

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections.

A flaw in nghttp2's nghttpx proxy allows remote HTTP request smuggling and cross-client response poisoning by forwarding malformed HTTP/1.1 Upgrade requests containing a Content-Length body. This is rated Moderate because successful exploitation requires high attack complexity on the backend server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users.