I think this is related to a "famous" bug in nginx: https://trac.nginx.org/nginx/ticket/915

(and your fix with proxy_hide_header: upgrade is fine until you are not using websockets...)

For me, the best option is to force HTTP/1.1 in PHP curl request:

curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);