Upgrade-Request — PoC Archivehttps://poc.intelseclab.com/tags/upgrade-request/Latest proof-of-concept entries.Hugoen-usFri, 03 Jul 2026 00:00:00 +0000nghttpx HTTP/1.1 Upgrade Request Body Response Queue Poisoninghttps://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: nghttp2's nghttpx reverse proxy. Tags: nghttp2, nghttpx, reverse-proxy, request-smuggling, response-queue-poisoning, http-desync, upgrade-request, cache-poisoning.networkHighnghttp2nghttpxreverse-proxyrequest-smugglingresponse-queue-poisoninghttp-desyncupgrade-requestcache-poisoningNext.js WebSocket Upgrade SSRF (Self-Hosted) (CVE-2026-44578)https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-websocket-upgrade-ssrf-self-hosted/High severity (CVSS 8.6) — web · CVE-2026-44578. Status: Weaponized. Affects: Next.js standalone router server (next start). Tags: SSRF, WebSocket, upgrade-request, Next.js, self-hosted, unauthenticated, metadata-service.webHighSSRFWebSocketupgrade-requestNext.jsself-hostedunauthenticatedmetadata-service