Author: Alexander Gerasimov

nghttp2 1.70.0 rpms released

nghttp2 1.70.0 rpms released and added to all supported platforms.

Major changes:

Require C++23 by @tatsuhiro-t in #2688 Adopt Designated initializers part1 by @tatsuhiro-t in #2689 Adopt Designated initializers part2 by @tatsuhiro-t in #2690 Adopt Designated initializers part3 by @tatsuhiro-t in #2691 tests: Make const values static const by @tatsuhiro-t in #2692 src: Rewrite util::split_str and its variants by @tatsuhiro-t in #2693 src: Adopt std::string::resize_and_overwrite by @tatsuhiro-t in #2694 src: Pass std::chrono::{time_point,duration} by value by @tatsuhiro-t in #2695 Bump mruby to 4.0.0 by @tatsuhiro-t in #2696 src: Fix warning “space between quotes and suffix is deprecated in C++23” by @tatsuhiro-t in #2697 lib, tests: Use C-style comment by @tatsuhiro-t in #2698 src: Avoid std::chrono::high_resolution_clock by @tatsuhiro-t in #2699 src: Add noexcept to user-defined literals by @tatsuhiro-t in #2700 src: Replace std::optional with std::expected by @tatsuhiro-t in #2701 src/util: Adopt std::expected for error handling by @tatsuhiro-t in #2702 get_socket_error: Return errno of getsockopt if it fails by @tatsuhiro-t in #2703 src: Use util::stream_error by @tatsuhiro-t in #2704 src: Get rid of std::stringstream by @tatsuhiro-t in #2705 src: Modernize Header and HeaderRef by @tatsuhiro-t in #2707 src/http2: Adopt std::expected by @tatsuhiro-t in #2708 src/tls: Adopt std::expected by @tatsuhiro-t in #2709 nghttpx: Adopt std::expected for Connection read/write by @tatsuhiro-t in #2710 Nghttpx dconn expected by @tatsuhiro-t in #2711 Nghttpx downstream expected by @tatsuhiro-t in #2712 Nghttpx http2session expected by @tatsuhiro-t in #2713 Nghttpx upstream expected by @tatsuhiro-t in #2714 Nghttpx clienthandler expected by @tatsuhiro-t in #2715 Nghttpx httpdownstreamconnection expected by @tatsuhiro-t in #2716 Nghttpx expected by @tatsuhiro-t in #2717 Nghttpx http2upstream expected by @tatsuhiro-t in #2718 Nghttpx http3upstream expected by @tatsuhiro-t in #2719 Nghttpx mruby expected by @tatsuhiro-t in #2720 Nghttpx quic expected by @tatsuhiro-t in #2721 nghttpx: Adopt std::expected for QUICConnectionHandler by @tatsuhiro-t in #2722 Nghttpx tls expected by @tatsuhiro-t in #2723 nghttpx: Rewrite time_t_from_asn1_time with ASN1_TIME_diff for boringssl by @tatsuhiro-t in #2724 Nghttpx livecheck expected by @tatsuhiro-t in #2725 Nghttpx dns expected by @tatsuhiro-t in #2726 Nghttpx memcached expected by @tatsuhiro-t in #2727 Nghttpx misc expected by @tatsuhiro-t in #2728 Nghttpx worker expected by @tatsuhiro-t in #2729 Nghttpx connhandler expected by @tatsuhiro-t in #2730 nghttpx: Pass WorkerEvent without explicit std::move by @tatsuhiro-t in #2731 nghttpx: Adopt std::expected for worker_process_event_loop by @tatsuhiro-t in #2732 nghttpx: Adopt std::expected for parse_config by @tatsuhiro-t in #2733 Nghttpx config expected by @tatsuhiro-t in #2734 Src fixup by @tatsuhiro-t in #2735 nghttpx: Adopt std::expected for main routines by @tatsuhiro-t in #2736 H2load expected by @tatsuhiro-t in #2737 nghttp: Adopt std::expected by @tatsuhiro-t in #2738 nghttpd: Adopt std::expected by @tatsuhiro-t in #2739 HtmlParser: Adopt std::expected by @tatsuhiro-t in #2740 src: Adopt size_t literal suffix by @tatsuhiro-t in #2742 nghttp: put pseudo headers before normal headers by @zhanhb in #2741 h2load: Replace std::cerr with std::print by @tatsuhiro-t in #2744 h2load: Replace std::cout with std::print by @tatsuhiro-t in #2745 nghttpx: Migrate to std::print by @tatsuhiro-t in #2746 Nghttp print by @tatsuhiro-t in #2747 Nghttpd print by @tatsuhiro-t in #2748 src: Migrate std::cout to std::print by @tatsuhiro-t in #2749 src: Simplify as_string_view usage by @tatsuhiro-t in #2750 src: Migrate fprintf to C++ counterparts by @tatsuhiro-t in #2751 src: Use std::println without argument to print just line separator by @tatsuhiro-t in #2752 nghttpx: Create CID encryption ctx per worker by @tatsuhiro-t in #2753 nghttpx: Use std::unique_ptr for quic_keying_materials_ by @tatsuhiro-t in #2754 Src optimize by @tatsuhiro-t in #2755 src: Provide faster hash functions for OpenSSL forks by @tatsuhiro-t in #2756 src: Adopt std::expected for http2::make_websocket_accept_token by @tatsuhiro-t in #2757 src: NSDMI part1 by @tatsuhiro-t in #2758 src: Add noexcept to move ctor and assignment operator by @tatsuhiro-t in #2759 build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 by @dependabot[bot] in #2760 build(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in #2761 src: MSDMI part2 by @tatsuhiro-t in #2762 Avoid azure ubuntu mirror by @tatsuhiro-t in #2763 src: MSDMI part3 by @tatsuhiro-t in #2764 src/allocator: Rewrite concat_string_ref with fold expression by @tatsuhiro-t in #2765 src: Fix build failure on macos26 by @tatsuhiro-t in #2766 cmake: Remove CMAKE_CXX_STANDARD 23 that is not needed there by @tatsuhiro-t in #2767 Fix base64 oob by @tatsuhiro-t in #2768 Nghttpx upgrade by @tatsuhiro-t in #2769 Make NGHTTP2_HTTP_FLAG_* macros and make them unsigned by @tatsuhiro-t in #2770 Define flags as macros by @tatsuhiro-t in #2771 Make NGHTTP2_EXTPRI_INC_MASK unsigned by @tatsuhiro-t in #2772 src: Avoid zero-argument std::println by @kmehltretter82 in #2773 build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #2774 GHA: Add Cygwin build by @tatsuhiro-t in #2775 Fix docker build by @tatsuhiro-t in #2776 lib: Rewrite integer decoder in http by @tatsuhiro-t in #2777 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2778 Avoid deprecated ngtcp2 and nghttp3 apis by @tatsuhiro-t in #2779 net: Use macros for win32 hton*/ntoh* fallbacks by @tatsuhiro-t in #2780 lib: Add nghttp2_downcase_byte by @tatsuhiro-t in #2781 Rework HTTP header validation by @tatsuhiro-t in #2782 Bump sfparse by @tatsuhiro-t in #2783 helper: Initialize array with designated initializers by @tatsuhiro-t in #2784 Reformat downcase table by @tatsuhiro-t in #2785 http: Initialize array with designated initializers by @tatsuhiro-t in #2786 Upper case hex integer literals in huffman data table by @tatsuhiro-t in #2787 Upcase hex by @tatsuhiro-t in #2788 Nghttpx h2 stream write timeout by @tatsuhiro-t in #2789 bpf, examples, tests: Upper case hex integer literals by @tatsuhiro-t in #2790 Reformat huffman data table by @tatsuhiro-t in #2791 nghttpx: Provide frontend and backend stream timeouts by @tatsuhiro-t in #2794 build(deps): bump github.com/quic-go/quic-go from 0.59.1 to 0.60.0 by @dependabot[bot] in #2792 nghttpx: Reformat help message to make it editor friendly by @tatsuhiro-t in #2796 nghttpx: Drop connection when frontend write rate is too low by @tatsuhiro-t in #2797 build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #2799 build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2800 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2802 nghttpx: Drop h3 connection when frontend write rate is too low by @tatsuhiro-t in #2803 build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #2804 Gcc 16 by @tatsuhiro-t in #2805 nghttpx: NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE is not allowed in on_frame_recv_callback by @tatsuhiro-t in #2806 nghttpx: Rename completeCb_ to complete_cb_ by @tatsuhiro-t in #2807 nghttpx: Remove unused unordered_set include by @tatsuhiro-t in #2808 Require nghttp3 >= 1.17.0 by @tatsuhiro-t in #2810 Add the missing header value check for priority header field by @tatsuhiro-t in #2813 build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #2814 build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2815 Count CONTINUATIONS per its frame header by @tatsuhiro-t in #2818 build(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 by @dependabot[bot] in #2819 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2820 Bump neverbleed by @tatsuhiro-t in #2821 Bump llhttp to v9.4.2 by @tatsuhiro-t in #2822 nghttpx: Reset quic upstream addr fd to the current path by @tatsuhiro-t in #2823

ngtcp2 1.25.0 rpms released

ngtcp2 1.25.0 rpms released and added to all supported platforms.

Major changes:

– Fix build error with gcc-16 by @tatsuhiro-t – build(deps): bump actions/cache from 5 to 6 by @dependabotbot – ksl: Align keys in 8 bytes boundary by @tatsuhiro-t – bbr: Update longterm variable computation by @tatsuhiro-t – Remove condition that is always true by @tatsuhiro-t – Verify the end offset of STREAM frame before updating flow control by @tatsuhiro-t – Rework connection flow window accounting after sending STOP_SENDING by @tatsuhiro-t – Stop buffering data after shutting downstream read by @tatsuhiro-t in – Cleanup by @tatsuhiro-t – Update bbr by @tatsuhiro-t – Update doc by @tatsuhiro-t – Add ngtcp2_stream_close2 callback by @tatsuhiro-t – examples: Adopt ngtcp2_stream_close2 callback by @tatsuhiro-t – Tweak stream_close2 callback behavior by @tatsuhiro-t – Expand NGTCP2_MAX_INITIAL_CRYPTO_OFFSET to 64K by @tatsuhiro-t – Partially revert #2242 by @tatsuhiro-t – Make max CRYPTO offsets configurable by @tatsuhiro-t – Minor cleanup by @tatsuhiro-t – Optimize rob by @tatsuhiro-t – build(deps): bump actions/setup-python from 6 to 7 by @dependabotbot – Optimize acktr by @tatsuhiro-t – Remove ngtcp2_acktr_entry and squeeze len into key by @tatsuhiro-t – Minor fixups by @tatsuhiro-t – Amend ba2e5f0142863a0a539671e0194de6019008ad3e (part of #2255) by @tatsuhiro-t – Deal with the case where client migrate back to the original path by @tatsuhiro-t – crypto/quictls: Rework the global initialization by @tatsuhiro-t – ksl: Remove unnecessary NULL initialization by @tatsuhiro-t – Document about C11 compilers by @tatsuhiro-t – Bump boringssl by @tatsuhiro-t – Bump aws-lc to v5.4.0 by @tatsuhiro-t – Bump picotls by @tatsuhiro-t – fuzz: Fuzz more parameters like CID, AEAD tag, and transport parameters by @tatsuhiro-t – Revert “Make max CRYPTO offsets configurable” by @tatsuhiro-t – Require nghttp3 >= 1.18.0 by @tatsuhiro-t

ngtcp2 libraries stack built with OpenSSL 4.0.1. QUIC client name is osslclient.

nghttp3 1.18.0 rpms released

nghttp3 1.18.0 rpms released and added to all supported platforms.

Major changes:

– ksl: Align keys in 8 bytes boundary by @tatsuhiro-t – Update doc by @tatsuhiro-t – Add nghttp3_conn_close_stream2 and nghttp3_stream_close2 callback by @tatsuhiro-t – Validate header length against the estimated uncompressed length by @tatsuhiro-t – ksl: Port ngtcp2 changes by @tatsuhiro-t – Document C compilers by @tatsuhiro-t – Fix build error with gcc-16 by @tatsuhiro-t

NGINX 1.31.3 Mainline with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.31.3 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

*) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533). Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

*) Security: uninitialized memory access might occur when using unnamed regex captures with the “slice” directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

*) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434). Thanks to P4P3R-HAK.

*) Change: the size of headers and trailers in HTTP/2 responses in the ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with “proxy_buffer_size” and “grpc_buffer_size” directives.

*) Change: loading of external entities is now disabled in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the “xml_external_entities” directive in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the “proxy_socket_sndbuf”, “proxy_socket_rcvbuf”, “fastcgi_socket_sndbuf”, “fastcgi_socket_rcvbuf”, “grpc_socket_sndbuf”, “grpc_socket_rcvbuf”, “scgi_socket_sndbuf”, “scgi_socket_rcvbuf”, “uwsgi_socket_sndbuf”, “uwsgi_socket_rcvbuf”, “tunnel_socket_sndbuf”, and “tunnel_socket_rcvbuf” directives.

*) Feature: cache line size detection for loongarch64. Thanks to Miao Wang.

*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order pseudo-headers.

*) Bugfix: in flow control in the ngx_http_v2_module.

*) Bugfix: “[error] upstream sent frame for unknown stream” and “[crit] cache file … contains invalid header” messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the “proxy_cache_revalidate” directive was used.

*) Bugfix: nginx might send the “Upgrade” header line in HTTP/2 and HTTP/3 responses.

*) Bugfix: in the ngx_http_perl_module. Thanks to Maxim Dounin.

*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.

*) Bugfix: in the ngx_http_auth_basic_module on Solaris.

*) Bugfixes and improvements in the ngx_http_tunnel_module.

NGINX 1.30.4 Stable with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.30.4 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

    *) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; 
       a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533).
       Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

    *) Security: uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

    *) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434).
       Thanks to P4P3R-HAK.

ngtcp2 1.24.0 rpms released

ngtcp2 1.24.0 rpms released and added to all supported platforms.

Major changes:

– crypto: Add openssl libs to cryptotest by @tatsuhiro-t – Add –disable-crypto configure option by @tatsuhiro-t – crypto: Add ngtcp2_crypto_ossl_free by @tatsuhiro-t – examples: Avoid the deprecated nghttp3 APIs by @tatsuhiro-t – lib: Add recv_stop_sending callback by @pimterry – lib: Add ngtcp2_conn_set_max_stream_data_thresh by @tatsuhiro-t – lib: Tweak ngtcp2_conn_set_max_stream_data_thresh by @tatsuhiro-t – Remove max stream data thresh by @tatsuhiro-t – Rewrite window filter from scratch by @tatsuhiro-t – lib: Tweak app-limited detection by @tatsuhiro-t – build(deps): bump actions/checkout from 6 to 7 by @dependabotbot – lib: Simplify app-limited conditions by @tatsuhiro-t – Bump openssl to v4.0.1 by @tatsuhiro-t – Bump boringssl by @tatsuhiro-t – Bump aws-lc to v5.1.0 by @tatsuhiro-t – Bump picotls by @tatsuhiro-t – Bump wolfssl to v5.9.2-stable by @tatsuhiro-t

ngtcp2 libraries stack built with OpenSSL 4.0.1. QUIC client name is osslclient.

nghttp3 1.17.0 rpms released

nghttp3 1.17.0 rpms released and added to all supported platforms.

Major changes:

– lib: Add nghttp3_downcase_byte by @tatsuhiro-t – lib: Fix header name validation by @tatsuhiro-t – lib: Reformat downcase table by @tatsuhiro-t – Add nghttp3_conn_stream_flushed by @tatsuhiro-t – lib: Take into account non-DATA frame in nghttp3_conn_is_stream_flushed by @tatsuhiro-t – Update scripts by @tatsuhiro-t – Reformat huffman data tables by @tatsuhiro-t – Update doc by @tatsuhiro-t – lib: Treat non-existent stream flushed by @tatsuhiro-t – Bump sfparse by @tatsuhiro-t – lib: Add the public API to encode and decode variable-length integer by @tatsuhiro-t – build(deps): bump actions/checkout from 6 to 7 by @dependabotbot – Add missing version-added by @tatsuhiro-t

NGINX 1.30.3 Stable with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.30.3 Stable with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142)  added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

  • Security: a heap memory buffer overflow might occur in a worker
  • Security: a heap memory buffer overread might occur in a worker

NGINX 1.31.2 Mainline with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.31.2 Mainline with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142) added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

  • Security: use-after-free might occur when using HTTP/3 and processing
  • Security: a heap memory buffer overflow might occur in a worker
  • Security: a heap memory buffer overread might occur in a worker
  • Change: now the $request_id variable uses SipHash-2-4.
  • Feature: the $ssl_sigalgs variable.
  • Bugfix: a variable defined by the “split_clients” directive might be constant time “secure_link” hash comparison.