CVE-2026-58055: nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
Last updated 2 July 2026
Other sources
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nghttp2 nghttpxto a version that resolves this vulnerability.Fixed in 1.69.0Patch HTTP Request/Response Smuggling via Upgrade Request with Content-Length - Configuration
Ensure nghttpx does not forward Upgrade requests with a Content-Length header/body onto reusable keep-alive backend connections while re-adding Upgrade/Connection headers; change behavior so Content-Length is not passed verbatim for Upgrade requests that include a body
nghttp2 nghttpx Content-Length handling for Upgrade requests = Pass Content-Length verbatim - Compensating control
Mitigate HTTP request/response smuggling and cross-client response-queue poisoning by preventing nghttpx proxy traffic from forwarding HTTP/1.1 Upgrade requests that include a Content-Length header/body onto reusable keep-alive backend connections (e.g., block/segregate such requests or isolate backends)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58055?
CVE-2026-58055 has a medium severity rating of 5.4.
How does CVE-2026-58055 allow for HTTP Request/Response Smuggling?
CVE-2026-58055 allows smuggling by forwarding an HTTP/1.1 Upgrade request that carries a Content-Length header and body onto reusable backend connections.
What are the potential impacts of exploiting CVE-2026-58055?
Exploiting CVE-2026-58055 may lead to ambiguity in request processing, potentially allowing for malicious behavior in backend services.
Which versions of nghttp2 nghttpx are affected by CVE-2026-58055?
CVE-2026-58055 affects nghttp2 nghttpx versions up to and including 1.69.0.
How can I mitigate the risk from CVE-2026-58055?
To mitigate CVE-2026-58055, consider updating to a patched version of nghttp2 nghttpx that addresses this vulnerability.