nghttpx CVE-2026-58055

Exploitation requires that nghttpx is operating as a reverse proxy (not the HTTP/2 client or server library modes) and that backend connections are pooled and reused via HTTP keep-alive - the default configuration for nghttpx in proxy mode. The attacker must be able to send arbitrary HTTP/1.1 requests to the nghttpx listening interface (typically port 443 or 80), which is generally network-accessible by design. The critical conditional factor is backend behavior: the backend HTTP server must resolve the parsing ambiguity introduced by the Upgrade + Content-Length combination in the attacker's favor - treating the body as a separate pipelined request rather than rejecting the malformed message. This condition limits exploitation to specific backend stacks. No authentication is required at the nghttpx proxy layer (PR:N). The attack does not require user interaction (UI:N). Exploitation is not possible against HTTP/2 or HTTP/3 upstream connections where the Upgrade mechanism is not applicable; the vulnerability is specific to the HTTP/1.1 backend downstream path in shrpx_http_downstream_connection.cc.

The CVSS 4.0 score of 6.3 (Medium) reflects the real-world complexity of exploitation: AC:H correctly captures that the attack succeeds only when the downstream backend resolves the parsing ambiguity in the attacker's favor - not all backends are vulnerable to this specific interaction. The PR:N/UI:N metrics confirm unauthenticated exploitation with no victim interaction required, which elevates urgency despite the moderate score. The SI:L on the subsequent system reflects cross-client response-queue poisoning, which can leak other users' session data. The availability of a public PoC (hosted on GitHub by 'bikini/exploitarium') meaningfully raises real-world exploitation probability beyond what the CVSS score alone suggests, though no CISA KEV listing confirms active mass exploitation at time of analysis. The attack is probabilistic rather than deterministic - it depends on backend HTTP parser behavior - making this a high-priority finding for deployments where nghttpx fronts backends known to be lenient parsers (e.g., older Apache httpd, some Java servlet containers). Deployments fronting strict parsers that reject ambiguous messages are partially shielded. EPSS data was not provided in the input; exploitation probability cannot be quantified beyond 'elevated due to public PoC.'

An unauthenticated attacker sends a crafted HTTP/1.1 request to nghttpx bearing both an Upgrade header and a Content-Length body whose bytes spell out a malicious HTTP request (e.g., a GET to an admin endpoint). nghttpx forwards the ambiguous message onto an existing keep-alive connection to a backend that interprets the Content-Length body as a second, pipelined HTTP request. The backend processes the attacker's injected request and places the response into the shared queue, where it is delivered to a different legitimate client making a concurrent request - leaking that client's session data or serving attacker-controlled content as if it were a legitimate server response. A public PoC demonstrating this queue-poisoning primitive is available at https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc.