nginx 1.31.7 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.
The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:
- the newest image, from whichever pool was released last: docker pull codeitus/nginx
- the newest Mainline image: docker pull codeitus/nginx:mainline
- this exact release: docker pull codeitus/nginx:1.31.7
HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx
Major changes:
- Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
- Feature: now backend SSL certificates can be verified by IP address.
- Feature: now QUIC supports reconfiguration and binary upgrade when using the “quic_bpf” directive.
- Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
- Bugfix: a segmentation fault might occur in a worker process or “request count is zero” alerts might appear in logs if the “X-Accel-Redirect” header line was cached and the cached response was then served to a client.
- Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the “alias” directive.
- Bugfix: QUIC connections might be closed with the “quic flood detected” message in logs if the “http3_stream_buffer_size” directive was set to a small value; the bug had appeared in 1.27.5.
- Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now “SSL_read() failed” errors appear in logs in this case.
- Bugfix: “[crit] SSL_write() failed” messages might appear in logs when an error occurred while reading from an SSL connection.
Fixed vulnerabilities:
- Security: a buffer overflow might occur in a worker process when using the “alias” directive if the request URI was changed by the “rewrite” directive and was then mapped to a file path (CVE-2026-15176).
- Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).
- Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the “client_max_body_size” limit or injecting data in the proxied request (CVE-2026-95101).
- Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).
- Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has “include virtual” commands (CVE-2026-97205).