Reported by 2 outlets

Timeline

1. original reporting

   Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches

   gbhackers.com · 22d ago · September 21st, 2026

   Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments. Research by YesWeHack researcher Alex Brumen highlights flaws that occur when web caches create cache keys by directly […] The post New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches

   cyberpress.org · 22d ago · September 21st, 2026

   The research, published by YesWeHack researcher Alex Brumen, shifts attention away from traditional web cache poisoning flaws involving unkeyed HTTP input. Instead, it targets the construction of the cache key itself, particularly configurations that concatenate multiple variable-length request components without delimiters. New Cache Key Injection Attack web caches (Source: yeswehack) Web caches store HTTP responses under keys assembled from selected request properties, often including the scheme, host, URI, query string, cookies, or headers. Nginx deployments may use a configuration resembling: proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; The danger is not that the resulting string is unhashed. Rather, it is that adjacent values are merged ambiguously. Yeswehack stated that two distinct requests can produce an identical final key when an attacker shifts characters between controllable fragments such as the URL path and the Accept header. For example, a legitimate request for / with Accept: / can generate the same final key as a request for / with Accept: / , depending on the remaining key components. If the latter request causes Nginx to cache an attacker-influenced resp

3. update from gbhackers.com

   Cache Key Injection on Nginx: by manipulating HTTP headers, an attacker can force the cache to serve poisoned responses to other users

   gbhackers.com · 22d ago · September 21st, 2026

   Cache Key Injection on Nginx: by manipulating HTTP headers, an attacker can force the cache to serve poisoned responses to other users

   via Mastodon https://gbhackers.com/new-cache-key-injection-attack/