[nginx] Fixed finalization of active subrequests without buffering.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx/rev/e1356a13f09f
branches:  
changeset: 9584:e1356a13f09f
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 28 14:42:16 2026 +0300
description:
Fixed finalization of active subrequests without buffering.

Previously, finalization of active subrequests without buffering did not
expect any additional write events, and did not change the write event
handler, preserving the value which was previously set.  However, in
some unusual code paths it is possible that the subrequest being
finalized will be in the posted request list, leading to the write event
handler being called after finalization, potentially causing issues
(known as CVE-2026-56434, though security impact is questionable).

In particular, such a situation was observed with SSI and proxying: when
an include was finalized and the main request was woken up, postponed
main request data were not flushed as long as the size of busy buffers
was below proxy_busy_buffers_size, and when another include arrived from
the upstream, it was posted from ngx_http_post_request() and then posted
again from the postpone filter.  With a static file as an include, this
caused "header already sent" alerts.

The fix is to set r->write_event_handler to the empty handler, similarly
to how it is handled in ngx_http_writer().

See also:
https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2

diffstat:

 src/http/ngx_http_request.c |  2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diffs (12 lines):

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2680,6 +2680,8 @@ ngx_http_finalize_request(ngx_http_reque
                 pr->postponed = pr->postponed->next;
             }
 
+            r->write_event_handler = ngx_http_request_empty_handler;
+
             c->data = pr;
 
         } else {