Метка: nginx

nginx 1.31.3 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

*) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533). Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

*) Security: uninitialized memory access might occur when using unnamed regex captures with the «slice» directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

*) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434). Thanks to P4P3R-HAK.

*) Change: the size of headers and trailers in HTTP/2 responses in the ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with «proxy_buffer_size» and «grpc_buffer_size» directives.

*) Change: loading of external entities is now disabled in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the «xml_external_entities» directive in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the «proxy_socket_sndbuf», «proxy_socket_rcvbuf», «fastcgi_socket_sndbuf», «fastcgi_socket_rcvbuf», «grpc_socket_sndbuf», «grpc_socket_rcvbuf», «scgi_socket_sndbuf», «scgi_socket_rcvbuf», «uwsgi_socket_sndbuf», «uwsgi_socket_rcvbuf», «tunnel_socket_sndbuf», and «tunnel_socket_rcvbuf» directives.

*) Feature: cache line size detection for loongarch64. Thanks to Miao Wang.

*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order pseudo-headers.

*) Bugfix: in flow control in the ngx_http_v2_module.

*) Bugfix: «[error] upstream sent frame for unknown stream» and «[crit] cache file … contains invalid header» messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the «proxy_cache_revalidate» directive was used.

*) Bugfix: nginx might send the «Upgrade» header line in HTTP/2 and HTTP/3 responses.

*) Bugfix: in the ngx_http_perl_module. Thanks to Maxim Dounin.

*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.

*) Bugfix: in the ngx_http_auth_basic_module on Solaris.

*) Bugfixes and improvements in the ngx_http_tunnel_module.

nginx 1.30.4 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

    *) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; 
       a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533).
       Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

    *) Security: uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

    *) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434).
       Thanks to P4P3R-HAK.

nginx 1.30.3 Stable with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142)  added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

• Security: a heap memory buffer overflow might occur in a worker
• Security: a heap memory buffer overread might occur in a worker

nginx 1.31.2 Mainline with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142) added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

• Security: use-after-free might occur when using HTTP/3 and processing
• Security: a heap memory buffer overflow might occur in a worker
• Security: a heap memory buffer overread might occur in a worker
• Change: now the $request_id variable uses SipHash-2-4.
• Feature: the $ssl_sigalgs variable.
• Bugfix: a variable defined by the «split_clients» directive might be constant time «secure_link» hash comparison.

nginx 1.31.1 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

*) Security: a heap memory buffer overflow might occur in a worker process when using a configuration with overlapping captures in ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-9256). Thanks to Mufeed VH of Winfunc Research.

nginx 1.30.2 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

Fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).

nginx 1.31.0 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

    *) Security: when using the "proxy_set_body" directive, an attacker
       might inject data in the proxied request to an HTTP/2 backend
       (CVE-2026-42926).
       Thanks to Mufeed VH of Winfunc Research.

    *) Security: a heap memory buffer overflow might occur in a worker
       process while handling a specially crafted request by
       ngx_http_rewrite_module, potentially resulting in arbitrary code
       execution (CVE-2026-42945).
       Thanks to Leo Lin.

    *) Security: a heap memory buffer overread might occur in a worker
       process while handling a specially crafted response by
       ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker
       to cause a disclosure of worker process memory or segmentation fault
       in a worker process (CVE-2026-42946).
       Thanks to Leo Lin.

    *) Security: a heap memory buffer overread might occur in a worker
       process while handling a specially sent response with decoding from
       UTF-8 via the "charset_map" directive, allowing an attacker to cause
       a limited disclosure of worker proccess memory or segmentation fault
       in a worker process (CVE-2026-42934).
       Thanks to David Carlier.

    *) Security: when using HTTP/3, processing of connection migration might
       cause new QUIC streams to receive a new client address before
       validation, allowing an attacker to cause address spoofing
       (CVE-2026-40460).
       Thanks to Rodrigo Laneth.

    *) Security: use-after-free might occur during DNS server response
       processing if the "ssl_ocsp" directive was used, allowing an attacker
       to cause worker process memory corruption or segmentation fault in a
       worker process (CVE-2026-40701).
       Thanks to Leo Lin.

    *) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
       "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding",
       "Upgrade" header lines, and "TE" with any value other than
       "trailers".

    *) Change: the ngx_http_dav_module now rejects a COPY or MOVE requests
       when the source and destination resources are the same or have a
       parent-child collection relationship.

    *) Change: the logging level of the "invalid alert" and "record layer
       failure" SSL errors, and of the "SSL alert number N" for any alert
       numbers has been lowered from "crit" to "info".

    *) Change: now the "sticky" module can be disabled with the
       --without-http_upstream_sticky_module configure option; the
       --without-http_upstream_sticky configure option is deprecated.

    *) Feature: the ngx_http_tunnel_module; support for authenticating to
       proxies in the "auth_basic", "satisfy", and "auth_delay" directives.

    *) Feature: the "least_time" directive inside the "upstream" block.

    *) Feature: the "proxy_ssl_alpn" directive in the stream module.

    *) Bugfix: connections with HTTP/2 backends might not be cached when
       using the "proxy_set_body" or "proxy_pass_request_body" directives.

    *) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be
       transferred incorrectly if the first line was not fully read.

nginx 1.30.1 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

Fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701).

nginx 1.30.0 stable version has been released, incorporating new features and bug fixes from the 1.29.x mainline branch — including Early Hints, HTTP/2 to backend and Encrypted ClientHello, sticky sessions support for upstreams, Multipath TCP support, the default proxy HTTP version set to HTTP/1.1 with keep-alive enabled, and more.

Nginx 1.30.0 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories.

Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

— 1.30.x stable branch.