curl 8.22.0 Fixes CONNECT Trailer Filtering for HTTP Proxies

curl 8.22.0, released on September 2, 2026, includes a focused fix for HTTP proxy tunnels: trailers received at the end of a chunked CONNECT response are now identified as CONNECT metadata. That lets curl and libcurl suppress them consistently when an application requests that proxy CONNECT headers stay out of its normal header output.

The change is narrow, but it matters to collectors, verification systems, and other proxy clients that parse response headers automatically. A stray proxy trailer can be mistaken for a header from the destination, contaminate stored metadata, or break code that assumes the callback contains only one response layer.

Source: curl project, curl 8.22.0 release notes and “proxy: CONNECT trailers handling,” released September 2, 2026; underlying change dated August 27, 2026.

What changed

When an HTTP proxy creates a tunnel, the client first sends CONNECT to the proxy. The proxy's response belongs to tunnel establishment, not to the final destination response. Applications can use CURLOPT_SUPPRESS_CONNECT_HEADERS in libcurl, or --suppress-connect-headers in the curl tool, to prevent those CONNECT response headers from reaching normal header or write output.

The edge case appears when the proxy's CONNECT response uses chunked transfer coding and supplies trailer fields after the final chunk. Before this fix, the chunk parser marked those fields as trailers and headers, but did not also mark them as CONNECT data. The suppression filter therefore lacked the information needed to remove them with the rest of the proxy handshake.

curl 8.22.0 passes an explicit “inside CONNECT response” state into the chunk parser. A trailer from that context is now tagged as header, trailer, and CONNECT metadata. The existing suppression rule can then treat it like the other CONNECT fields.

What this fix does not mean

This is not a change to destination response trailers. It does not disable trailers globally, remove proxy diagnostics from verbose traces, alter proxy authentication, or change the payload inside an established tunnel. It specifically aligns CONNECT-response trailers with the suppression behavior already expected for CONNECT-response headers.

The option still has to be enabled. curl's documentation says suppression affects header and write output, while verbose and trace diagnostics remain available. That separation is useful: production parsers can receive a clean destination response while operators retain protocol evidence in controlled debug logs.

Who should test the update

Prioritize validation if a workload meets all or most of these conditions:

• it uses an HTTP or HTTPS proxy with tunneling;
• it enables CONNECT-header suppression;
• it captures headers through CURLOPT_HEADERFUNCTION, CURLOPT_WRITEFUNCTION, --dump-header, or --show-headers;
• its proxy or gateway can return chunked CONNECT responses;
• downstream logic interprets headers as destination metadata;
• it recently showed unexplained trailer fields, duplicate header groups, or parser failures.

Clients that do not tunnel through an HTTP proxy, do not suppress CONNECT headers, or never receive chunked CONNECT responses are unlikely to observe this specific difference.

A safe before-and-after test

Use a staging proxy that is authorized for testing and can produce a chunked CONNECT response with a trailer. Keep the target, proxy, curl build options, request, timeouts, and header-capture settings identical between the old and new client versions.

For the command-line tool, run one capture with --proxytunnel, --dump-header, and --suppress-connect-headers. Store verbose or trace output separately from the application header file. In libcurl, enable CURLOPT_HTTPPROXYTUNNEL, set CURLOPT_SUPPRESS_CONNECT_HEADERS to 1, and record exactly what reaches the header callback.

The acceptance rule is simple:

1. The CONNECT response and its trailer do not appear in the application header output.
2. The destination response headers still appear once and in order.
3. The destination body is unchanged.
4. Debug evidence remains available in the deliberately enabled trace channel.
5. Authentication, tunnel establishment, and connection reuse still match the baseline.

Do not test with production credentials in a shared log. Redact proxy usernames, passwords, cookies, authorization fields, target identifiers, and personal data.

Why header ownership matters in data pipelines

A proxy tunnel produces at least two protocol layers: the proxy's CONNECT exchange and the destination's response. Reliable data collection must preserve that ownership boundary. Without it, a parser might store a proxy field as page evidence, feed it into a cache key, treat it as a compliance signal, or compare it against the wrong baseline.

This fix reduces one source of ambiguity, but operators should still label every captured field by layer. For a structured approach, use the proxy response classification guide and the proxy CONNECT failure matrix.

Upgrade checklist

• Confirm the deployed binary reports curl 8.22.0 and the expected TLS backend.
• Identify workloads that enable CONNECT-header suppression.
• Determine whether header callbacks and body callbacks share a destination.
• Reproduce one ordinary CONNECT response and one chunked response with a trailer.
• Compare application header output, trace output, body hash, and exit status.
• Verify 407 responses remain classified as proxy authentication events.
• Check retry logic does not turn parser differences into extra requests.
• Roll out by a small cohort and watch header-parse failures.
• Keep the prior binary and configuration available until the observation window closes.

The broader curl proxy upgrade test matrix can help cover DNS, IPv4/IPv6, TLS, authentication, and reuse behavior beyond this one fix.

FAQ

Does this affect every HTTP proxy response?

No. The corrected case is a trailer from a chunked CONNECT response when CONNECT-header suppression is in use. Ordinary destination headers and trailers follow their normal handling.

Should applications stop logging proxy CONNECT details?

No. Keep diagnostic evidence in a protected verbose or trace channel with secrets removed. The goal is to keep proxy-handshake metadata out of application response parsing, not to eliminate observability.

Is upgrading alone enough?

No. Verify the actual packaged build, because operating systems and containers may ship a different curl or libcurl version than expected. Test callback output with the same proxy behavior used in production.

Compliance note

Use proxies only for authorized destinations and purposes. Respect applicable law, contracts, destination terms, rate limits, privacy requirements, and data-retention policies. Header captures can contain credentials or personal information, so minimize collection, restrict access, and redact before sharing.