Preliminary research

Cache key injection: Smuggling poison through the door

Alex Brumen · YesWeHack · 17 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Nginx case studies show how ambiguous cache-key boundaries can map distinct requests to the same cached response. The article examines conditional cache poisoning and disclosure risks and distinguishes upstream host defaults from custom request-derived keys.

Record

Researcher

Alex Brumen

Published by

YesWeHack

Date

17 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier cache-key research (2020)

Tags

• cache-poisoning
• cache-deception
• nginx
• http

This page is the archive's own catalogue record. The research is the work of Alex Brumen, first published at the original source. Preserved copies are kept so the citation survives its host.