When using the error_log directive, a newline character in the URL (%0a) is
logged directly, without escaping.
As a result, it is possible to inject false entries into the server log.

Example configuration:
server {
  server_name example;
  access_log /var/log/nginx/example.log;
  error_log /var/log/nginx/example.err;
}

Request:
curl '
http://example/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20'

Log:
2026/07/30 11:38:57 [error] 7608#7608: *58 open() "/usr/share/nginx/html/
2026/07/30 13:66:66 oops
2026/07/30 13:66:66 " failed (2: No such file or directory), client:
127.0.0.1, server: example, request: "GET
/%0a2026/07/30%2013:66:66%20oops%0a2026/07/30%2013:66:66%20 HTTP/1.1",
host: "example"



Pozdrawiam/Regards,
Andrzej Borsuk

Also access log doesn't have that issue:

::1 - - [30/Jul/2026:12:32:33 +0200] "GET /%0A2026/07/30%2013:66:66%20oops%0A2026/07/30%2013:66:66%20 HTTP/1.1" 404 146 "-" "curl/8.21.0"

I thought both error_log and access_log had the same default log_format "combined".

Just out of curiosity, have you checked if this is replicated in nginx
main upstream versions (both stable and mainline)

If they are, then perhaps this needs forwarded to NGINX teams to fix.


Thomas