ssl_preread is an NGINX Stream feature that inspects the TLS ClientHello before the connection is fully handled. It can read handshake details such as the server name indication (SNI) and other early metadata without terminating TLS itself. That allows a proxy to make routing decisions before decrypting traffic.
This matters because early connection parsing is security-critical code: it processes attacker-controlled bytes very early in the session. In real deployments, ssl_preread is used for TLS passthrough routing, virtual hosting, and traffic segmentation. Defenders value it for flexible load balancing, but it also expands the attack surface when combined with variables, regular expressions, or complex configuration logic. If parsing or buffer handling is flawed, malformed ClientHello data can trigger crashes or worse. For that reason, systems using ssl_preread should be kept patched and tested with the exact routing rules they use in production.