It might be. Depends on how well nginx or another frontend will sanitize or parse things. Another link says it's a range header issue. So if nginx doesn't handl

It might be. Depends on how well nginx or another frontend will sanitize or parse things. Another link says it's a range header issue. So if nginx doesn't handle line folding, but HTTP.SYS does, you might still sneak it by. HTTP is a clusterfuck to parse. Anyways I doubt MS would write "Mitigating factor: Not using IIS." Also note, this does not just apply to IIS. It applies to the Windows kernel HTTP stack (?!), HTTP.SYS. Which is used by many things apart from IIS. And can even be listening when your app is not running (OS opens a socket on port 80, 443, whatever, runs it as SYSTEM (PID 4), then passes the HTTP messages off to your app if your app is up and connected.)