Tinyproxy CVE-2026-31842

No special conditions — remote unauthenticated exploitation against Tinyproxy versions through 1.11.3. Attacker sends HTTP request with Transfer-Encoding header using non-standard capitalization (e.g., 'Chunked' instead of 'chunked') to trigger request desynchronization.

Real-world risk is significant for environments using Tinyproxy as a security control layer or reverse proxy fronting Node.js/Nginx backends. The CVSS 7.5 score (High severity) reflects network accessibility, low attack complexity, and high availability impact, accurately representing the denial-of-service dimension. The attack vector (AV:N) and lack of privilege requirements (PR:N) mean any network-positioned attacker can trigger the condition without authentication. However, the assessment must differentiate between the two exploitation paths: (1) DoS via backend worker exhaustion is immediately exploitable with trivial technical skill, requiring only HTTP client capability to send capitalized headers; (2) Security control bypass requires specific deployment architecture where Tinyproxy performs request-body inspection or filtering, limiting applicability. No EPSS data provided for probability assessment, but public technical disclosure in GitHub issue #604 significantly lowers exploitation barrier. No confirmed active exploitation (CISA KEV) status. The SSVC framework would likely classify this as 'attend' priority: exploitation is technically automatable (simple HTTP request modification), technical impact is partial (availability focused), but requires specific architectural conditions for maximum impact. Organizations using Tinyproxy in security-critical reverse proxy roles should prioritize remediation; those using it for simple forward proxying face primarily DoS risk.

An attacker identifies a web application infrastructure using Tinyproxy as a reverse proxy in front of Node.js application servers that perform security validation on request bodies. The attacker crafts an HTTP POST request with 'Transfer-Encoding: Chunked' (capitalized C) containing malicious payload data in chunk-encoded format in the message body. Tinyproxy's case-sensitive comparison fails to recognize the capitalized header, treats the request as having no body, and immediately forwards headers upstream while leaving chunk-encoded malicious payload in the input buffer. The Node.js backend correctly interprets the capitalized Transfer-Encoding header per RFC 7230, enters chunked decoding mode, and waits indefinitely for chunk data that Tinyproxy will never forward. The connection hangs, consuming a backend worker thread. By repeating this attack across multiple connections, the attacker exhausts the backend worker pool, causing legitimate requests to queue indefinitely and achieving application-level denial of service without triggering rate-limiting or volumetric DDoS protections that focus on request rates rather than connection state exhaustion.