Tag: nginx

nginx 1.31.8 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Mainline image: docker pull codeitus/nginx:mainline
• this exact release: docker pull codeitus/nginx:1.31.8

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Change in internal API: now the JSON parser reports strings with escape sequences as separate events, and the ngx_json_unescape_string() function decodes a string into a separate buffer.
• Change: now the path specified in the “working_directory” directive is relative to nginx prefix directory, but not to the current directory.
• Bugfix: worker processes exited on start or during reconfiguration if an invalid directory was specified in the “working_directory” directive.
• Bugfix: worker processes might be terminated abnormally on a SIGBUS signal when using HTTP/3 on platforms with strict alignment requirements.
• Bugfix: “recv() failed (5: Input/output error)” alerts might appear in logs when closing SSL connections if kernel TLS was used with OpenSSL 3.2.0 or newer.
• Bugfix: nginx could not be built on Solaris if the --with-control-api option was used.

nginx 1.31.7 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Mainline image: docker pull codeitus/nginx:mainline
• this exact release: docker pull codeitus/nginx:1.31.7

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
• Feature: now backend SSL certificates can be verified by IP address.
• Feature: now QUIC supports reconfiguration and binary upgrade when using the “quic_bpf” directive.
• Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
• Bugfix: a segmentation fault might occur in a worker process or “request count is zero” alerts might appear in logs if the “X-Accel-Redirect” header line was cached and the cached response was then served to a client.
• Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the “alias” directive.
• Bugfix: QUIC connections might be closed with the “quic flood detected” message in logs if the “http3_stream_buffer_size” directive was set to a small value; the bug had appeared in 1.27.5.
• Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now “SSL_read() failed” errors appear in logs in this case.
• Bugfix: “[crit] SSL_write() failed” messages might appear in logs when an error occurred while reading from an SSL connection.

Fixed vulnerabilities:

• Security: a buffer overflow might occur in a worker process when using the “alias” directive if the request URI was changed by the “rewrite” directive and was then mapped to a file path (CVE-2026-15176).
• Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).
• Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the “client_max_body_size” limit or injecting data in the proxied request (CVE-2026-95101).
• Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).
• Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has “include virtual” commands (CVE-2026-97205).

nginx 1.30.6 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Stable image: docker pull codeitus/nginx:stable
• this exact release: docker pull codeitus/nginx:1.30.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Change: the logging level of the “invalid alert” and “record layer failure” SSL errors, and of the “SSL alert number N” for any alert numbers has been lowered from “crit” to “info”.
• Bugfix: a segmentation fault might occur in a worker process or “request count is zero” alerts might appear in logs if the “X-Accel-Redirect” header line was cached and the cached response was then served to a client.
• Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the “alias” directive.
• Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.
• Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
• Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
• Bugfix: a segmentation fault might occur in a worker process if the “select” method was used.
• Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.30.4.
• Bugfix: in the ngx_http_perl_module.
• Bugfix: in flow control in the ngx_http_v2_module.
• Bugfix: “[error] upstream sent frame for unknown stream” and “[crit] cache file … contains invalid header” messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the “proxy_cache_revalidate” directive was used.
• Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.
• Bugfix: in the ngx_http_auth_basic_module on Solaris.
• Bugfixes in HTTP/3, ngx_http_image_filter_module, ngx_http_slice_module, and ngx_http_memcached_module.

Fixed vulnerabilities:

• Security: a buffer overflow might occur in a worker process when using the “alias” directive if the request URI was changed by the “rewrite” directive and was then mapped to a file path (CVE-2026-15176).
• Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).
• Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the “client_max_body_size” limit or injecting data in the proxied request (CVE-2026-95101).
• Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).
• Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has “include virtual” commands (CVE-2026-97205).

nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Mainline image: docker pull codeitus/nginx:mainline
• this exact release: docker pull codeitus/nginx:1.31.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
• Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
• Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
• Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
• Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.

Fixed vulnerabilities:

• Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

nginx 1.30.5 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Stable image: docker pull codeitus/nginx:stable
• this exact release: docker pull codeitus/nginx:1.30.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.

Fixed vulnerabilities:

• Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

nginx 1.31.5 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Mainline image: docker pull codeitus/nginx:mainline
• this exact release: docker pull codeitus/nginx:1.31.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Feature: control API.
• Feature: predicate locations.
• Feature: the ngx_http_json_module.
• Feature: the “client_body_early_read” directive.
• Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
• Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
• Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
• Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.

nginx 1.31.4 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.1 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

• the newest image, from whichever pool was released last: docker pull codeitus/nginx
• the newest Mainline image: docker pull codeitus/nginx:mainline
• this exact release: docker pull codeitus/nginx:1.31.4

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

• Feature: the “proxy_protocol” directive in the stream and mail modules now supports the PROXY protocol version 2.
• Change: now HTTP/2 and gRPC requests to backends are always sent with the “:authority” pseudo-header, and HTTP/1.1 requests – with the “Host” header.
• Bugfix: a segmentation fault might occur in a worker process if the “select” method was used.
• Bugfix: incomplete gRPC responses with a non-zero “Content-Length” header line are now treated as malformed.
• Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.31.3.
• Bugfix: in the ngx_http_perl_module.
• Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and ngx_http_grpc_module.

nginx 1.31.3 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

*) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533). Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

*) Security: uninitialized memory access might occur when using unnamed regex captures with the “slice” directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

*) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434). Thanks to P4P3R-HAK.

*) Change: the size of headers and trailers in HTTP/2 responses in the ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with “proxy_buffer_size” and “grpc_buffer_size” directives.

*) Change: loading of external entities is now disabled in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the “xml_external_entities” directive in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the “proxy_socket_sndbuf”, “proxy_socket_rcvbuf”, “fastcgi_socket_sndbuf”, “fastcgi_socket_rcvbuf”, “grpc_socket_sndbuf”, “grpc_socket_rcvbuf”, “scgi_socket_sndbuf”, “scgi_socket_rcvbuf”, “uwsgi_socket_sndbuf”, “uwsgi_socket_rcvbuf”, “tunnel_socket_sndbuf”, and “tunnel_socket_rcvbuf” directives.

*) Feature: cache line size detection for loongarch64. Thanks to Miao Wang.

*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order pseudo-headers.

*) Bugfix: in flow control in the ngx_http_v2_module.

*) Bugfix: “[error] upstream sent frame for unknown stream” and “[crit] cache file … contains invalid header” messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the “proxy_cache_revalidate” directive was used.

*) Bugfix: nginx might send the “Upgrade” header line in HTTP/2 and HTTP/3 responses.

*) Bugfix: in the ngx_http_perl_module. Thanks to Maxim Dounin.

*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.

*) Bugfix: in the ngx_http_auth_basic_module on Solaris.

*) Bugfixes and improvements in the ngx_http_tunnel_module.

nginx 1.30.4 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

    *) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; 
       a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533).
       Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

    *) Security: uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

    *) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434).
       Thanks to P4P3R-HAK.

nginx 1.30.3 Stable with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142)  added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

• Security: a heap memory buffer overflow might occur in a worker
• Security: a heap memory buffer overread might occur in a worker