While HTTP/2 delivers faster web performance, it also introduces new security risks. Imperva researchers uncovered major flaws stemming from new mechanisms like stream multiplexing and compression, as well as vulnerabilities in popular implementations such as Apache, IIS, and NGINX. These issues enable attacks like slow read, HPACK bombs, and stream abuse—reviving threats thought to be resolved in HTTP 1.1. As the attack surface expands, web application firewalls (WAFs) are essential for protecting systems and ensuring a safe transition to HTTP/2. Faster doesn't always mean safer.

Join for free to read