Not a comprehensive article, but the worst security footgun, by far (IMO), is $uri. It’s completely unsafe to use $uri in basically any directives! You cannot redirect using it, proxy_pass using it, or you will have a bad time.

https://reversebrain.github.io/2021/03/29/The-story-of-Nginx...