ddos-simulation.com
Build a test plan

Layer 7 · Web Server / Ingress · NGINX

NGINX Resilience & CVE Suite

Comprehensive resilience simulations targeting NGINX event-loop worker boundaries, HTTP/3 QUIC module CPU limits, SSI recursive depth, shared SSL session cache mutexes, and large client header pools.

Target NGINX / NGINX Plus Layer L7 & L4 Techniques 14 simulations Access Self-service / Quote

Suite Overview

NGINX handles high concurrency via asynchronous event-driven worker processes. Because workers are single-threaded event loops, blocking operations (such as regex compilation, resolver buffers, or shared memory lock contention) or worker crashes (SIGSEGV in C modules) immediately degrade all concurrent client connections sharing that worker.

MP4 Range Header Crash (CVE-2024-7347)

cve_2024_7347 — Probes NGINX ngx_http_mp4_module range header parsing to verify worker crash protection under crafted atom offsets.

QUIC ACK Range CPU Burn (CVE-2024-24989)

cve_2024_24989 — Floods crafted QUIC packets with dense, fragmented ACK range lists to evaluate NGINX ngx_http_v3_module ACK range processing CPU bounds.

QUIC MTU Probe Crash (CVE-2024-24990)

cve_2024_24990 — Sends malformed MTU discovery probe frames to test NGINX QUIC packet sizing calculations against integer underflow.

Resolver Buffer Overwrite (CVE-2025-23014)

cve_2025_23014 — Sends HTTP requests with host headers triggering complex upstream DNS resolution chains to evaluate ngx_resolver buffer bounds.

SSI Subrequest Loop (CVE-2025-24513)

cve_2025_24513 — Injects cyclical Server Side Include (SSI) directives and subrequest headers to test NGINX subrequest depth limits.

Regex Map Buffer Overflow (CVE-2026-42533)

cve_2026_42533 — Sends request headers targeting complex regex map directives to test NGINX worker buffer safety.

HTTP/3 Frame Mismatch Crash (CVE-2026-42530)

cve_2026_42530 — Sends out-of-sequence QUIC frame packets to evaluate NGINX HTTP/3 state machine crash protection.

SSL OCSP Stapling Crash (CVE-2026-40701)

cve_2026_40701 — Initiates rapid TLS handshakes with client certificate requests to test NGINX OCSP verification safety.

NGINX Shared SSL Cache Contention (nginx_ssl_session_cache_lock)

nginx_ssl_session_cache_lock — Initiates rapid concurrent TLS handshakes targeting ssl_session_cache shared:SSL:xx to evaluate worker spinlock contention under TLS load.

NGINX Large Header Buffer Exhaustion (nginx_client_header_churn)

nginx_client_header_churn — Floods headers alternating across client_header_buffer_size and large_client_header_buffers thresholds to evaluate NGINX memory pool recycling.

NGINX Subrequest Depth Starvation (nginx_subrequest_recursion)

nginx_subrequest_recursion — Sends requests triggering nested auth_request and internal redirect chains to test NGINX NGX_HTTP_MAX_SUBREQUESTS bounds.

NGINX Gunzip Buffer Starvation (nginx_gunzip_bomb_exhaustion)

nginx_gunzip_bomb_exhaustion — Sends compressed HTTP request bodies and gzip transfer streams to evaluate ngx_http_gunzip_filter_module decompressor memory safety.

Safe Execution

All probes run against verified customer infrastructure with automatic error-rate and latency circuit breakers.

Rehearse your NGINX configuration resilience safely.

Build a test plan
← All DDoS simulations