nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.
The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:
- the newest image, from whichever pool was released last: docker pull codeitus/nginx
- the newest Mainline image: docker pull codeitus/nginx:mainline
- this exact release: docker pull codeitus/nginx:1.31.6
HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx
Major changes:
- Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
- Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
- Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
- Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
- Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.
Fixed vulnerabilities:
- Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).