Month: September 2026

Security update: NGINX 1.31.6 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
  • Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
  • Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
  • Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
  • Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: NGINX 1.30.5 Stable RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.30.5 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Stable image: docker pull codeitus/nginx:stable
  • this exact release: docker pull codeitus/nginx:1.30.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: mod_http3 v0.0.71 RPM and DEB packages released

mod_http3 v0.0.71 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • A host with “h3” in Protocols now serves HTTP/3 with the certificate mod_ssl resolved for it (SSLCertificateFile and mod_md alike), the way mod_http2 rides mod_ssl. H3CertificatePath and H3CertificateKeyPath are removed; drop them from existing configurations.
  • Select the HTTP/3 certificate by SNI, so each virtual host on a shared port serves its own certificate instead of the first host’s.
  • Give every virtual host its own mod_http3 configuration (AP_MODULE_FLAG_ALWAYS_MERGE). A host without H3 directives used to share the main server’s, so per-host settings such as H3AltSvc and H3AltSvcMaxAge were silently ignored and hosts could not carry their own certificate.
  • Test suite: stop.conf now names the same pid file as httpd.conf, so “apachectl -k stop” actually stops the server on httpd builds whose default pid file lives in run/; before, every restart in the suite kept talking to the previous server.

Fixed vulnerabilities:

  • SECURITY: Load the HTTP/3 certificate and key in post_config, while httpd still runs privileged, so a root-only key no longer fails in the unprivileged child and both mod_ssl and mod_http3 read the same files.

Security update: mod_http3 v0.0.70 RPM and DEB packages released

mod_http3 v0.0.70 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • Advertised a QPACK dynamic table, sized by H3QpackTableCapacity and H3QpackBlockedStreams, so request headers compress as they do over HTTP/2.
  • Made the request worker pool tunable with H3MinWorkers, H3MaxWorkers and H3MaxWorkerIdleSeconds instead of a fixed 16 to 64 threads.
  • Added H3StreamTimeout, so a client that stops reading can no longer park a request worker until it goes away.
  • Added H3MaxStreamErrors, closing a connection whose client keeps sending malformed requests instead of answering them forever.
  • Published the mod_ssl TLS environment (SSL_PROTOCOL, SSL_CIPHER and friends) for HTTP/3 requests, which mod_ssl does not manage.
  • Added H3SessionTickets, so an operator can control whether returning clients resume instead of running a full handshake.
  • Added H3SocketBufferSize, so the QUIC socket no longer drops datagrams from an undersized OS receive buffer once a connection runs at speed.
  • Enforced H3IdleTimeout in the module event loop, so a connection with no requests is closed instead of being held open by QUIC keepalive pings.
  • Rejected a malformed HTTP/3 request with a stream error instead of closing the connection, so requests in flight beside it survive.
  • Build against httpd 2.4.x as well as trunk; response buckets and the child_stopped hook are now selected at compile time.
  • Detect the stable or devel httpd at configure time and backport the graceful drain to the 2.4.x branch.

Fixed vulnerabilities:

  • SECURITY: Updated the httpd submodule so mpm_event tolerates a connection it never accepted, ending a child crash on an ErrorDocument over HTTP/3.
  • SECURITY: Applied LimitRequestFields and LimitRequestFieldSize to HTTP/3, so a client can no longer grow a stream’s memory with unbounded headers.

NGINX 1.31.5 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.5 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: control API.
  • Feature: predicate locations.
  • Feature: the ngx_http_json_module.
  • Feature: the “client_body_early_read” directive.
  • Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
  • Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
  • Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
  • Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.