Comment by casca

Workaround:

    if ($request_uri ~ " ") {
        return 403;
    }

The issue is the handling of unescaped spaces. These are illegal but nginx accepts them. The workaround is to throw an error any time someone sends the invalid space.