Glossary · Security

HTTP Request Smuggling

HTTP request smuggling exploits disagreements between a front-end proxy and back-end server about where one request ends and the next begins.

Updated October 28, 2026

HTTP request smuggling is an attack that abuses inconsistent parsing of message boundaries between two HTTP processors, typically a reverse proxy or CDN and an origin server. The attacker sends an ambiguous request so the proxy sees one request while the backend sees two, "smuggling" a hidden request into another user's connection.

Why it matters

The ambiguity usually comes from the Content-Length and Transfer-Encoding: chunked headers, or from HTTP/2 to HTTP/1.1 downgrades. Impact can include bypassing front-end access controls, poisoning caches, capturing other users' requests and delivering reflected attacks without any user click. It is hard to detect because everything looks like valid HTTP to each component alone.

Mitigations include keeping proxies and servers patched, rejecting requests that contain both headers, normalizing at the edge, and using HTTP/2 end to end where possible.

Example

A classic ambiguous shape, simplified:

POST / HTTP/1.1
Host: example.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

If the front end honors Content-Length and the back end honors Transfer-Encoding, SMUGGLED becomes the start of the next request.

Common mistakes

  • Running mismatched proxy and origin software without testing the combination.
  • Assuming a WAF will catch malformed framing.
  • Leaving upstream connection reuse enabled without strict parsing.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · Cloud & HostingNginxNginx is an open-source web server and reverse proxy known for handling many concurrent connections efficiently with an event-driven architecture.Guide · Hosting & CDNCDN Explained: What It Does, When You Need One, and How Caching WorksUnderstand how a content delivery network works, which headers control caching, what origin shield does, when a CDN helps or hurts, and how to verify it is working.7 min readGuide · Web BasicsHow to Read HTTP Headers for Beginners (What Each Line Tells You)Learn to view and read HTTP response headers with a free tool or curl, and what status, server, cache, redirect and security headers mean for your website.7 min readGuide · PerformanceHTTP/2 and HTTP/3 Explained: What Changes and How to Enable ThemUnderstand multiplexing, QUIC and head-of-line blocking, when HTTP/2 and HTTP/3 actually help, and how to enable and verify them on nginx and Cloudflare.7 min readError fix · Browser errorsERR_SPDY_PROTOCOL_ERROR: Fix Chrome's HTTP/2 Connection FailuresERR_SPDY_PROTOCOL_ERROR is Chrome's older name for an HTTP/2 stream or framing failure. Clear sockets, test without HTTP/2, and fix header or proxy limits.4 min readError fix · Server errorsHTTP 505 HTTP Version Not Supported: Causes and FixesFix HTTP 505 Version Not Supported. Learn why a server rejects an HTTP version, from h2c and HTTP/1.0 proxies to malformed request lines, and how to correct it.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.