nghttpx CVE-2026-58055

nghttpx is the reverse proxy binary shipped with the nghttp2 library (cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*), which provides HTTP/1.1 and HTTP/2 proxying. The vulnerability is rooted in CWE-444 (Inconsistent Interpretation of HTTP Requests), a class of flaws where an intermediary and a backend parse the same byte stream differently. The specific trigger is the HTTP/1.1 protocol upgrade mechanism: a client sends an Upgrade request to switch protocols, but also includes a Content-Length header with a body. RFC 7230 treats the combination as ambiguous - the body could belong to the upgrade handshake or be interpreted as the start of a new pipelined request. nghttpx failed to block or strip this body before forwarding onto a reusable keep-alive backend connection, and simultaneously re-added the Connection and Upgrade hop-by-hop headers. The commit diff (ab28105c) reveals the fix required: adding a blocked_request_buf guard in can_detach_downstream_connection() to prevent connection reuse while an Upgrade body remains unprocessed, introducing should_block_request_body() logic that holds the body until the backend confirms the upgrade, rejecting CONNECT requests carrying Content-Length with HTTP 400, and deferring blocked buffer processing until after the backend response is received via process_blocked_request_buf_on_response().