nghttp2's nghttpx proxy forwards an HTTP/1.1 Upgrade request that includes a Content-Length header and body to backend connections. The proxy re‑adds Upgrade and Connection headers but passes the original Content-Length verbatim. This practice corresponds to CWE-444 (Fragmentation of HTTP Requests). If a backend interprets the resulting ambiguous message in the attacker's favor, it can enable HTTP request/response smuggling and cross‑client response‑queue poisoning, potentially allowing an attacker to inject or manipulate data seen by other clients.

nghttp2 nghttpx users running version 1.69.0 or earlier are affected. The vulnerability applies to all builds of nghttp2 that use the nghttpx proxy component before the mentioned version.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in KEV, suggesting limited known exploitation. The likely attack vector requires an external attacker to send a crafted HTTP/1.1 Upgrade request to the proxy with a Content-Length header and body, and a backend that resolves the ambiguous message in the attacker's favor. The risk is therefore moderate and contingent on the presence of a susceptible backend.