AIKIDO-2026-659663

TL;DR

When proxying a request to an upstream over HTTP/1, the plugin relayed the upstream response and advertised the client-facing connection as reusable (keep-alive) even when the incoming request body had not been fully consumed. If the upstream responded before the request body was read, the unread body bytes remained buffered on the kept-alive HTTP/1 connection, leaving the parser mid-body so a following request on that connection is not recognized and is silently dropped until the client times out. On reused or pooled downstream connections this desynchronizes the connection and causes denial of service, with potential cross-request corruption where connections are shared across clients. The fix sets the connection: close response header whenever the request is not complete (!req.complete), forcing the connection to close instead of being reused.