Nginx Cache Key Injection Lets Attackers Bypass Access Controls, Trigger CPDoS, and Deliver Stored XSS

YesWeHack researcher Alex Brumen demonstrates that Nginx cache keys built by concatenating request variables without separators can be collided to bypass a localhost-only /admin restriction, serve attacker-induced 404s (CPDoS), achieve stored XSS via…

Security researcher Alex Brumen of YesWeHack published a web cache poisoning technique called cache key injection targeting Nginx configurations whose proxy_cache_key concatenates variables without delimiters, such as "$scheme$host$request_uri$http_accept". Because distinct requests can collapse into the same cache key, crafted requests collide with legitimate cache entries. Proofs of concept show three impacts: (1) access control bypass, where a collision returns cached administrative responses from a localhost-only /admin restriction to unauthorized external users; (2) cache-poisoned denial of service (CPDoS), where an attacker-induced 404 is cached and later served for a legitimate page such as /home; and (3) stored XSS via HTTP/HTTPS scheme confusion with a malicious Host header that is reflected into script sources, enabling attacker JavaScript to be stored and served. The research also shows that requests containing an Authorization header can bypass Cloudflare's edge cache, allowing direct poisoning of the Nginx origin cache. Recommended mitigations are delimited or structured cache keys, avoiding caching of authenticated responses in shared caches, and strict Host header validation.

• Researcher: Alex Brumen, identified as a YesWeHack researcher (both reports published 2026-09-21).
• Technique: cache key injection abusing Nginx cache keys that concatenate request components without separators, e.g., proxy_cache_key "$scheme$host$request_uri$http_accept".
• Access control bypass: cache key collisions return cached /admin responses to unauthorized external users; Report 2 specifies the PoC defeats a localhost-only /admin restriction, while Report 1 describes bypassing access controls on paths…
• Denial of service: a CPDoS variant caches an attacker-induced 404 that is later served for the legitimate /home page.
• Stored XSS: HTTP/HTTPS scheme confusion with a malicious/reflecting Host header injects attacker JavaScript; Report 1 attributes the XSS to a malicious Host header, and Report 2 notes Host headers reflected into script sources.
• Cloudflare bypass: requests with an Authorization header bypass Cloudflare's edge cache, enabling direct poisoning of the Nginx origin cache.
• Mitigations: use delimited or structured cache keys, exclude authenticated responses from shared caches, and enforce strict Host header validation.
• No CVE id, affected Nginx version range, or vendor patch is mentioned in either report.