nginx
Web · products/nginx.yaml · RSS
Latest 1.31.8 Oct 21, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| mainline | 1.31.8 | Oct 21, 2026 |
| stable | 1.30.6 | Oct 14, 2026 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 1.31 | 1.31.8 | May 13, 2026 | — · maintained |
| 1.30 | 1.30.6 | Apr 14, 2026 | — · maintained |
| 1.29 | 1.29.8 | Jun 24, 2025 | May 13, 2026 · ended |
| 1.28 | 1.28.3 | Apr 23, 2025 | Apr 14, 2026 · ended |
| 1.27 | 1.27.5 | May 28, 2024 | Jun 24, 2025 · ended |
| 1.26 | 1.26.3 | Apr 23, 2024 | Apr 23, 2025 · ended |
| 1.25 | 1.25.5 | May 23, 2023 | May 29, 2024 · ended |
| 1.24 | 1.24.0 | Apr 11, 2023 | Apr 23, 2024 · ended |
| 1.23 | 1.23.4 | Jun 21, 2022 | May 23, 2023 · ended |
| 1.22 | 1.22.1 | May 24, 2022 | Apr 11, 2023 · ended |
| 1.21 | 1.21.6 | May 25, 2021 | Jun 21, 2022 · ended |
| 1.20 | 1.20.2 | Apr 20, 2021 | May 24, 2022 · ended |
| 1.19 | 1.19.10 | May 26, 2020 | May 25, 2021 · ended |
| 1.18 | 1.18.0 | Apr 21, 2020 | Apr 20, 2021 · ended |
| 1.17 | 1.17.10 | May 21, 2019 | May 26, 2020 · ended |
| 1.16 | 1.16.1 | Apr 23, 2019 | Apr 20, 2020 · ended |
| 1.15 | 1.15.12 | Jun 5, 2018 | May 21, 2019 · ended |
| 1.14 | 1.14.2 | Apr 17, 2018 | Apr 23, 2019 · ended |
| 1.13 | 1.13.12 | Apr 25, 2017 | Jun 5, 2018 · ended |
| 1.12 | 1.12.2 | Apr 12, 2017 | Apr 17, 2018 · ended |
| 1.11 | 1.11.13 | May 24, 2016 | Apr 25, 2017 · ended |
| 1.10 | 1.10.3 | Apr 26, 2016 | Apr 12, 2017 · ended |
| 1.9 | 1.9.15 | Apr 28, 2015 | May 24, 2016 · ended |
| 1.8 | 1.8.1 | Apr 21, 2015 | Apr 26, 2016 · ended |
| 1.7 | 1.7.12 | Apr 24, 2014 | Apr 28, 2015 · ended |
| 1.6 | 1.6.3 | Apr 24, 2014 | Apr 21, 2015 · ended |
| 1.5 | 1.5.13 | May 7, 2013 | Apr 24, 2014 · ended |
| 1.4 | 1.4.7 | Apr 24, 2013 | Apr 24, 2014 · ended |
| 1.3 | 1.3.16 | May 15, 2012 | May 7, 2013 · ended |
| 1.2 | 1.2.9 | Apr 23, 2012 | Apr 24, 2013 · ended |
| 1.1 | 1.1.19 | Aug 1, 2011 | May 15, 2012 · ended |
| 1.0 | 1.0.15 | Apr 12, 2011 | Apr 23, 2012 · ended |
Recent releases
breakingWin32: removed the iocp event module
securitynginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
securitynginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
securityUpdated security policy report methods
securitynginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module…
securityNginx 1.31.3 security fixes
securitynginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the…
breakingGH: remove the set-creation-date.yaml workflow
securityNginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset)
securitynginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
securitynginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
securitynginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
securitynginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
securitynginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).
securitynginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142).
securityNginx 1.30.3 with security fixes
securitynginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
securitynginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
Security advisories
4.3 CVE-2025-23419 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. T…
7.5 CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
7.0 CVE-2022-41741 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the mod…
7.1 CVE-2022-41742 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the mod…
7.4 CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certifi…
9.8 CVE-2017-20005 NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date…
7.7 CVE-2021-23017 A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process c…
5.3 CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX…
4.8 CVE-2011-4968 nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
7.5 CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of da…
7.5 CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
6.5 CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value…
7.5 CVE-2018-16843 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_m…
7.5 CVE-2018-16844 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (no…
6.1 CVE-2018-16845 nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might…
7.5 CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggere…
7.8 CVE-2016-1247 The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubun…
7.5 CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, i…
5.3 CVE-2016-0747 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption)…
9.8 CVE-2016-0746 Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspe…