This question already has an answer here:
I've seen a couple of questions related to this, but none that specifically answers the question of what the risk is in the event that SSL termination is done downstream of the app on Nginx?
Scenario is fairly standard - Nginx runs on the perimeter, does SSL termination, acts as reverse proxy to static content, and forwards requests upstream to our app, which is running on a separate server.
Heartbleed, AFAIK, leaks data from the server running OpenSSL, which in our case is Nginx. Ignoring the issue of leaking private keys, which is clearly a problem, what other information could be harvested from the Nginx process?