Risks in Apache Traffic Server’s surge for CDNs choosing Varnish or Nginx

Apache Traffic Server (ATS) is the clear winner for high-scale caching and proxying, but its recent security posture creates a severe risk profile for any CDN architecture. The Apache Software Foundation disclosed two critical vulnerabilities on April 2, 2026, that allow remote threat actors to trigger denial-of-service conditions or execute HTTP request smuggling attacks. These flaws stem from how the server processes HTTP requests containing body data, specifically affecting the ATS 9.x branch from version 9.0.0 through 9.2.12 and the 10.x branch from 10.0.0 through 10.1.1. For operators currently evaluating ATS against Varnish or Nginx, these disclosures are not minor bugs; they represent a fundamental stability failure in the core traffic handling logic. I view this as a major red flag because the first vulnerability, CVE-2025-58136, allows an attacker to crash the server simply by sending a legitimate POST request without any special authentication. This ease of exploitation means a single malicious user can take enterprise networks offline, disrupting applications across entire regions. The second flaw, CVE-2025-65114, enables HTTP request smuggling by mishandling malformed chunked message bodies, which lets attackers bypass security controls and poison web caches. Since there is no configuration workaround for the smuggling issue, upgrading to version 9.1.13 or 10.1.2 is the only definitive way to secure the infrastructure. If you are running an unpatched instance right now, your cache integrity is already compromised.

Security gaps versus architectural complexity

The decision to adopt ATS often comes down to its advanced caching system, which rivals dedicated solutions like Varnish by supporting granular cache purging. However, the security landscape has shifted dramatically with the introduction of CVE-2025-49763, a memory exhaustion vulnerability in the Edge Side Includes plugin. Attackers can craft malicious requests that cause the server to process ESI recursively until available memory is exhausted, rendering the server unresponsive. This specific attack vector is particularly dangerous because it requires no authentication or privileged access, allowing remote disruption of critical web infrastructure. While the updated versions provide settings to reduce these issues, proper configuration changes remain essential to prevent infinite inclusion scenarios. In contrast, Nginx offers better built-in load balancing features such as round-robin and least connections, making it a more stable choice for reverse proxy setups where security and SSL termination are primary concerns. Nginx also provides native SSL support, whereas Varnish historically required external tools like Hitch or Nginx itself for TLS termination, adding layers of architectural complexity.

Varnish Enterprise recently introduced in-process TLS, delivering 150Gbps or more from a single server with dual 100 Gbps interfaces, which eliminates the need for external middlemen. This performance gain is significant for video delivery, where latency is unacceptable. Yet, the operational burden of managing multiple software pieces remains a valid concern for many teams. LiteSpeed presents another alternative, offering Apache compatibility with event-driven architecture, but it lacks the open-source transparency that drives community trust in Nginx and Apache. The cost of licensing for large deployments can become prohibitive, pushing organizations back toward open-source stacks. I would skip the bonus buy of complex proprietary solutions unless the specific throughput requirements justify the expense. The real question is whether the raw speed of ATS justifies the constant patch management cycle required to stay ahead of these recurring DoS vectors.