SteadyNode

Nginx / Envoy · HTTP 503

Envoy 503 UF: Upstream Connection Failure

Investigate Envoy 503 UF by checking cluster endpoints, DNS, connection pools, TLS, and upstream health. Use response flags and cluster statistics to locate the failing hop.

Origin / Network Firewall

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

ENVOY-503-UF

Fault domain

Origin / Network Firewall

Why it happened

Envoy's UF response flag means the proxy could not establish an upstream connection. Missing endpoints, refused connections, DNS failures, or TLS errors can prevent a cluster from serving the request.

Actionable fixes

  1. Inspect x-envoy-response-flags and cluster stats for connection failures, pending requests, and healthy host count.
  2. Verify endpoint discovery, DNS answers, upstream port, and network policy from the Envoy workload.
  3. Check upstream TLS SNI and trust configuration when the cluster uses TLS origination.

Why this error happened

Envoy's UF response flag means the proxy could not establish an upstream connection. Missing endpoints, refused connections, DNS failures, or TLS errors can prevent a cluster from serving the request.

Actionable fixes

  1. Inspect x-envoy-response-flags and cluster stats for connection failures, pending requests, and healthy host count.
  2. Verify endpoint discovery, DNS answers, upstream port, and network policy from the Envoy workload.
  3. Check upstream TLS SNI and trust configuration when the cluster uses TLS origination.

Network failure point

Client -> Envoy listener -> cluster endpoint selection -> upstream connect fails (UF) -> X

Verify origin directly via CLI

curl -sS -v -I --connect-timeout 3 --max-time 10 --resolve upstream.example.com:443:UPSTREAM_IP https://upstream.example.com/health

Configuration fix

envoy.yamlyaml
clusters:
  - name: api
    type: STRICT_DNS
    connect_timeout: 2s
    load_assignment:
      cluster_name: api
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address: { address: api.internal, port_value: 8080 }

Catch this failure before it becomes an outage

SteadyNode's external checks detect Envoy 503 responses and retain response flags, helping teams distinguish proxy connectivity failures from application-level errors.

No credit card required.

Start for free

Frequently asked questions

What does Envoy response flag UF mean?

UF means Envoy failed to connect to an upstream host for the request.

Can an empty Envoy cluster produce 503 UF?

Yes. Check endpoint discovery and healthy host counts before changing retry or timeout settings.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy