Published on August 20, 2026
New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts
Severity
High
Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have identified a new class of HTTP request smuggling attacks called CRLF-Powered Desync Attacks. The technique abuses HTTP header injection weaknesses that can escalate into serious attacks, including account takeover, HTTPOnly cookie theft, response queue poisoning, and potentially self-propagating desync worms.
The vulnerability is commonly associated with a specific Nginx configuration where the $uri variable is used directly within the proxy_pass directive. Because Nginx URL-decodes the request path before forwarding it to an upstream server, encoded CRLF characters (%0d%0a) can be converted into actual carriage-return and line-feed characters. This enables attackers to inject additional headers or manipulate the structure of requests sent to backend systems.
Researchers demonstrated that the technique could affect shared infrastructure, including CDNs and Kubernetes-based platforms, potentially exposing authentication tokens, session cookies, credit card information, and other sensitive data belonging to unrelated applications hosted on the same infrastructure.
How?
An attacker can craft a malicious HTTP request containing encoded CRLF sequences in the URL path. When Nginx processes the request and decodes the URL before forwarding it through a vulnerable proxy_pass configuration, the encoded sequences become actual HTTP line breaks.
By injecting carefully crafted CRLF sequences, an attacker can split the upstream request into multiple HTTP requests. This can cause Response Queue Poisoning (RQP), where the server incorrectly associates responses with different client requests, potentially causing sensitive responses from one user to be delivered to another.
The researchers also demonstrated CL.TE desynchronization by injecting a Transfer-Encoding header. This can create a discrepancy between how frontend and backend servers interpret the request, allowing attackers to bypass protections designed to prevent traditional request splitting.
The attack can also be triggered from a victim’s browser using JavaScript fetch() requests or navigation. This makes it possible to perform desynchronization attacks without direct access to internal infrastructure and, in certain scenarios, bypass network-based protections. When combined with XSS, attackers may be able to steal HTTPOnly session cookies indirectly and use compromised browsers to launch further attacks against other users, creating a potentially self-propagating desync worm.
Recommendation
Organizations should immediately audit Nginx configurations, particularly instances where $uri is used directly in proxy_pass directives. Review reverse-proxy and backend request parsing behavior to identify potential inconsistencies in how encoded CRLF characters, Content-Length, and Transfer-Encoding headers are processed.
Apply secure Nginx configuration practices, update affected components where fixes are available, and implement protections against HTTP request smuggling and header injection. Organizations should also test shared CDN, Kubernetes, and reverse-proxy infrastructure for cross-user response leakage and browser-triggered desynchronization attacks.
Security teams should treat CRLF-based header injection as a potentially high-impact vulnerability rather than a low-severity input validation issue, particularly when the affected application uses shared infrastructure or handles authenticated sessions.
Source