7 ms·
That's been fixed for years. The CVE I can find was resolved in 1.17.7 (Dec 2019), and further hardening was applied in 1.21.1 (Jul 2021).
by callahad 3y ago
That's been fixed for years. The CVE I can find was resolved in 1.17.7 (Dec 2019), and further hardening was applied in 1.21.1 (Jul 2021).
- yakshaving_jgt 3y agoCan nginx send requests upstream over HTTP/2? I see this question has remained unanswered for a couple of years. https://security.stackexchange.com/questions/257823/what-are-nginx-reverseproxy-users-doing-to-prevent-http-request-smuggling https://security.stackexchange.com/questions/257823/what-are...
- callahad 3y agoIt cannot. There's more detailed reasoning at https://trac.nginx.org/nginx/ticket/923 https://trac.nginx.org/nginx/ticket/923, but the tl;dr is: > nginx is already good at mitigating HTTP desync / request smuggling attacks, even without using HTTP/2 to backends. In particular because it normalizes Content-Length and Transfer-Encoding while routing requests (and also does not reuse connections to backend servers unless explicitly configured to do so)