cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names

The vulnerability stems from how cpp-httplib, a library used by Nginx, handles HTTP headers. The readheaders() function in httplib.h allows attackers to inject custom headers into the request. Subsequently, Nginx's Server::processrequest function appends its own internal metadata using the same header names without removing duplicates. This means an attacker-controlled header value can overwrite legitimate server metadata, potentially influencing authorization decisions or exposing sensitive information through logging. For example, an attacker could inject a malicious REMOTE_ADDR header to impersonate a trusted client or manipulate access controls. The impact is significant, as it can lead to unauthorized access, data breaches, and complete system compromise, particularly in environments where Nginx is used as a reverse proxy or load balancer.

Organizations utilizing Nginx as a reverse proxy, load balancer, or web server, particularly those running versions 0.27.0 or earlier, are at significant risk. Shared hosting environments where multiple users share the same Nginx instance are also vulnerable, as an attacker could potentially exploit this vulnerability through a compromised website to impact other tenants.

• nginx / server:

# Check for Nginx versions <= 0.27.0
nginx -v

• nginx / server:

# Examine access logs for unusual REMOTE_ADDR or REMOTE_PORT values
grep -i 'REMOTE_ADDR|REMOTE_PORT' /var/log/nginx/access.log

• nginx / server:

# Check Nginx configuration for use of REMOTE_ADDR/REMOTE_PORT in logging
cat /etc/nginx/nginx.conf | grep -i 'REMOTE_ADDR|REMOTE_PORT'

1. 2025-12-05Disclosure

   disclosure

2. 2025-12-05Patch

   patch

1. आरक्षित2025-12-04
2. प्रकाशित2025-12-05
3. संशोधित2025-12-10
4. EPSS अद्यतन2026-03-23

The primary mitigation is to upgrade Nginx to a version patched against this vulnerability. Refer to the official Nginx documentation for upgrade instructions specific to your operating system and deployment environment. If immediate upgrade is not possible, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to filter out or sanitize potentially malicious REMOTEADDR, REMOTEPORT, LOCALADDR, and LOCALPORT headers. Additionally, review Nginx configuration to minimize the use of these headers in logging and authorization processes. After upgrading, verify the fix by sending a crafted HTTP request containing the malicious headers and confirming that they are either rejected by the WAF or do not influence server behavior.