Proxy & Load Balancer Errors

Understanding Proxy errors

A proxy error tells you about the proxy's relationship with the upstream, not about the upstream's business logic. nginx's 502 means it could not get a valid response; 504 means the upstream did not answer in time; Envoy's flag codes (UH no healthy upstream, UF upstream connection failure, NR no route) are far more precise than the status code. Reading those flags is the fastest path to a diagnosis.

How to debug Proxy errors

1. Include upstream detail in the access log format: $upstream_addr, $upstream_status and $upstream_response_time in nginx turn a generic 502 into a specific one.
2. Bypass the proxy and call the upstream directly from the proxy host. If that works, the issue is proxy configuration: timeouts, buffers, DNS caching or TLS to the backend.
3. For Envoy, read the response flags in the access log rather than the status code. UH, UF, UO and NR each have distinct fixes.
4. Check that the proxy re-resolves DNS. nginx caches upstream IPs at startup by default, which breaks when backends move. Use a resolver directive with a variable upstream.
5. For header-size and body-size errors, raise the limit at every layer; CDN, load balancer and origin each enforce their own.

Tools worth reaching for

• nginx -T
• envoy access logs (response flags)
• haproxy -c -f
• curl --resolve
• traefik dashboard

All 17 Proxy errors

• Caddy upstream errorCaddy web server failed to connect to or receive response from upstream server.
• Cloudflare 520: Web server returns an unknown error NewCloudflare reached the origin but received a response it could not parse: an empty reply, a connection reset…
• Cloudflare 522: Connection timed outCloudflare edge could not establish TCP handshake to your origin. Origin offline, blocked by firewall, or wrong…
• Cloudflare 524: A timeout occurred NewCloudflare connected to the origin but no response arrived within the proxy read timeout, 100 seconds on most plans…
• Cloudflare errorCloudflare CDN encountered an error, often related to origin server connectivity or SSL issues.
• Cloudflare Worker 1101 runtime errorWorker script threw an exception during execution. Common causes: undefined variables, failed fetch, exceeded CPU/time…
• Envoy upstream resetEnvoy proxy received a reset from the upstream service before completing the request.
• HAProxy server errorHAProxy load balancer encountered an error with backend servers, often health check failures.
• Load balancer errorLoad balancer cannot route requests due to no healthy backend servers being available.
• Nginx: no live upstreams while connecting to upstream NewEvery server in the upstream block has been marked down by passive health checks. After max_fails failures within…
• Nginx: Upstream request timeoutNginx timed out waiting for response from upstream server. Backend processing too slow or unresponsive.
• nginx: upstream sent too big header while reading response header NewThe backend's response headers exceeded nginx's proxy buffer, so nginx discarded the response and returned 502. Large…
• Proxy authentication requiredProxy server requires authentication before allowing the request to proceed.
• Proxy connection failedUnable to establish connection through the configured proxy server. Proxy may be down or misconfigured.
• Proxy tunnel failedHTTPS tunnel through HTTP proxy failed, often due to proxy configuration or authentication issues.
• Traefik backend not foundTraefik reverse proxy cannot find a healthy backend service to route the request to.
• Upstream connect errorReverse proxy couldn't connect to the upstream server. Backend service may be unreachable.

Other categories

• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Ansible 10Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
• API 14Auth headers, payload limits, versioning, idempotency and webhook signatures.
• Apple 10Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
• Auth 11OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
• BigData 11Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
• C# 12NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
• C++ 11Segfaults, linker errors, memory corruption and template deduction failures.
• Caching 10Cache stampedes, stale content, Varnish and CloudFront failures.
• CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
• Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Dart 10Null safety, pub version solving and build toolchain problems.
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• DNS 10NXDOMAIN, SERVFAIL, timeouts, propagation and delegation problems.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• Elixir 9GenServer timeouts, supervision failures and Mix compilation problems.
• Email 8Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
• Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
• Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
• GraphQL 13Validation, depth limits, N+1 queries and fragment problems.
• gRPC 10Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
• Ingress 8404 default backend, missing TLS secrets, IngressClass and path matching.
• Java 19Class loading, dependency resolution, connection pools and JVM version…
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Logging 9Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
• MessageQueue 14Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
• Mobile 17Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
• Monitoring 12Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Performance 6GC pauses, thread pool starvation and event loop blocking.
• PHP 11Memory limits, execution timeouts, autoloading, Composer and PDO connections.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Regex 8Catastrophic backtracking, back references, escaping and engine differences.
• Ruby 11Bundler, migrations, native extensions, encoding and asset compilation.
• Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
• Scala 6Dependency resolution, binary compatibility and type inference failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Serverless 11Lambda timeouts, package size limits, VPC networking and cold starts.
• Shell 13Command not found, permissions, quoting, expansion and Makefile syntax.
• Storage 13S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
• Svelte 10Store subscriptions, load functions and server/client boundaries.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
• Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
• TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
• Virtualization 8VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
• Web3 7Gas estimation, nonce management and reverted transactions.
• WebAssembly 7Compile errors, memory bounds and host binding mismatches.
• WebServer 10nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
• Windows 10Installer failures, missing runtimes, update errors and permission problems.