The NGINX Stream module is the subsystem that handles Layer 4 traffic, including TCP and TLS stream proxying and routing. Unlike the HTTP module, it works before any web request is parsed, so it is often used for services such as databases, mail, and TLS passthrough. Features like ssl_preread, variables, regular-expression matching, and map directives let administrators inspect early connection data and choose an upstream dynamically.
That flexibility matters in security because configuration becomes part of the attack surface. Complex stream rules can push untrusted connection metadata through parsing and expression logic, which increases the risk of memory-safety bugs, misrouting, or denial of service if the implementation is flawed. In defense, teams should review stream blocks carefully, minimize unnecessary dynamic processing, and patch promptly when vulnerabilities affect the module. For attackers, the Stream module is attractive because it processes external data before application-layer protections are in place.