Thanks for your answer and apologies for the long delay.

How would the $http_host ever be empty? If I make a request without it I receive a 400 Bad Request as the HTTP spec defines it. Does Nginx still forward the request to the upstream server and populate a cache entry?

Additionally, if I make requests to our backend without a proper X-Forwarded-For header I will always receive a 404 and not data for a wrong domain.

Unfortunately we're still not able to reproduce the problem on our end, but still receive complaints from users encountering the problem.

We removed all caching from the problematic endpoint, but the problem still seems to persist. Are there any known conditions, where Nginx would pass on a wrong host to the upstream server for any kind of reason?