I ran a reproducible lab against nginx 1.24 (8 GiB Docker cap) studying HTTP/2 **HPACK amplification** the "HTTP/2 bomb" primitive (building on califio's published PoCs).

**What happens:** HPACK lets a client describe a huge header set in very few wire bytes. 

nginx must materialise those headers in memory *before* most limits apply. 

Result: wire bytes in ≪ heap bytes out.

**Lab numbers (single client, controlled environment):**

* `apex_scaled`, 100 connections: **\~200 MB wire → \~8.16 GiB worker RSS** (container cap filled)
* 50-connection campaign: worker RSS peaked at **\~8170 MiB** , probe timeouts during hold
   * Honest caveat: from one public IPv4 I only got \~ **31** concurrent full bombs with no persistent OOM — lab removes constraints that production still has
* **Fix:** nginx **≥ 1.29.8** — `http2_max_headers` / `max_headers` directive ([upstream commit](https://github.com/nginx/nginx/commit/365694160a85229a7cb006738de9260d49ff5fa2))

**Defense-in-depth if you can't patch immediately:** \`\`\`nginx http2\_max\_headers 100; http2\_max\_concurrent\_streams 32; limit\_conn\_zone $binary\_remote\_addr zone=h2conn:10m; limit\_conn h2conn 10; send\_timeout 15s; client\_header\_timeout 10s;

Full write-up includes A/B vs the baseline PoC, charts, and a reproducible Docker/Proxmox lab setup.

Open harness for authorized patch verification (not pointing at random hosts):

 [https://github.com/Leviticus-Triage/APEX-Ngin2dos](https://github.com/Leviticus-Triage/APEX-Ngin2dos)

Curious what nginx versions/configs people are still running in prod and whether anyone's seen RSS climb without obvious traffic spikes on HTTP/2.

HTTP/2 HPACK amplification vs nginx (pre-1.29.8): lab results, what actually fills worker memory, and the directives that stop it