nginx 1.27.5 → 1.29.3
8 releases · 1 breaking change · 6 security fixes · 0 advisories fixed
6security1breaking0deprecated14feature26fix
Breaking changes
- breaking Removed legacy charset directive from default config example. in 1.29.2
Security changes
- security nginx-1.29.1 mainline version has been released. This release includes a security fix for the vulnerability in the ngx_mail_smtp_module (CVE-2025-53859). See official CHANGES on nginx.org. in 1.29.1
- security nginx-1.28.3 stable version has been released. This release includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), security fixes… in 1.28.3
- security nginx-1.28.2 stable version has been released. This release includes a security fix for the SSL upstream injection vulnerability (CVE-2026-1642). See official CHANGES-1.28 on nginx.org. in 1.28.2
- security Added security policy in 1.28.0
- security Security: Update SECURITY.md in 1.28.0
- security Updated security policy to clarify experimental features in 1.28.0
Every release in between
featureSSL: support for compressed server certificates with BoringSSL.
otherHTTP CONNECT infrastructure
otherUpstream: reset local address in case of error.
otherSSL: $ssl_sigalg, $ssl_client_sigalg. initial work
otherGeo: the "volatile" parameter.
otherInheritance control for add_header and add_trailer.
fixOCSP: fixed invalid type for the 'ssl_ocsp' directive.
fixFixed compilation warnings on Windows after c93a0c48af87.
otherModules compatibility: increased compat section size.
othernginx-1.29.3 changes
featureAdded a previously missed changes entry in 1.29.1 relnotes.
breakingRemoved legacy charset directive from default config example.
fixQUIC: fixed ssl_reject_handshake error handling.
otherUpdated link to xslscript.
fixFixed inaccurate index directive error report
otherSNI: using ClientHello callback.
otherAWS-LC support changes
otherUpstream: overflow detection in Cache-Control delta-seconds.
otherMail: xtext encoding (RFC 3461) in XCLIENT LOGIN.
featureAdded F5 CLA workflow.
fixSSL: fixed "key values mismatch" with object cache inheritance.
othernginx-1.29.2 changes
securitynginx-1.29.1 mainline version has been released. This release includes a security fix for the vulnerability in the ngx_mail_smtp_module (CVE-2025-53859). See official CHANGES on nginx.org.
fixPCRE license fix for win32 zip
otherQUIC: adjusted OpenSSL 3.5 QUIC API feature test.
fixOPENSSL_VERSION_NUMBER fix for OpenSSL 3.0
otherkqueue build fixes
otherHTTP/3: limited prefixed integers encoded length.
fixHTTP/3: fixed handling :authority and Host with port.
fixHTTP/2: fixed flushing early hints.
fixHTTP/2 fixes for ":authority" vs "Host"
otherCertificate compression
fixAuth basic: fixed file descriptor leak on memory allocation error.
othersmtp module fixes
otherChanges 1.29.1
otherVersion bump 1.29.0
otherQUIC: silence unknown/reserved transport param "info" messages.
fixFixed -Wunterminated-string-initialization with gcc15.
fixHTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value.
otherWin32: couple of platform detection fixes
fixQUIC: fixed a typo.
otherOpenSSL build fixes with various no-opt.
fixQUIC: fixed sending acknowledgments with limited congestion window.
featureQUIC: using QUIC API introduced in OpenSSL 3.5.
otherSSL: support loading keys via OSSL_STORE.
featureCore: added support for TCP keepalive parameters on macOS.
otherHTTP Early Hints
otherHTTP/3: indexed field line encoding for "103 Early Hints".
otherUse NULL instead of 0 as null pointer constant
fixUpstream: fixed reinit request with gRPC and Early Hints.
otherQUIC: disabled OpenSSL 3.5 QUIC API support by default.
othernginx-1.29.0-RELEASE
securitynginx-1.28.3 stable version has been released. This release includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), security fixes…
otherRelease 1.28.3
securitynginx-1.28.2 stable version has been released. This release includes a security fix for the SSL upstream injection vulnerability (CVE-2026-1642). See official CHANGES-1.28 on nginx.org.
otherNginx 1.28.2
othernginx-1.28.1
otherHg to git transition
featureAdded Code of Conduct
securityAdded security policy
featureAdded contributing guidelines
featureAdded templates
featureAdded CI based on GitHub Actions.
otherUpdate Typo in win-utf
otherProxy: proxy_pass_trailers directive.
otherSSL: optional ssl_client_certificate for ssl_verify_client.
featureAdded new primary README.md file.
fixfix typo of bpf makefile debug option
otherSSL object cache
otherrelease-1.27.2
otherVersion bump.
otherQuic: prevent invalid stream frame retransmissions
otherAdding missing files from recent pcre2 library
securitySecurity: Update SECURITY.md
otherSSL: disabled TLSv1 and TLSv1.1 by default.
otherUpstream: re-resolvable servers
fixSSL: fixed MSVC compilation after ebd18ec1812b.
other"set by ngx_pcalloc" comments update
fixGitHub: Fix link to Contributing Guidelines
otherCore: change TCP keepalive from ms to seconds on DragonFly BSD
otherSSL: error message default in object caching API.
otherIssue #330 missing double quote.
otherMp4 stsc atom fixes
otherTLS default protocol versions fixup.
otherQUIC: prevented BIO leak in case of error.
fixQUIC: fixed client request timeout in 0-RTT scenarios.
securityUpdated security policy to clarify experimental features
fixQUIC: fixed accessing a released stream.
fixUpstream: fix NGX_COMPAT build without NGX_HTTP_SSL after 454ad0e.
featureQUIC: added missing casts in iov_base assignments.
fixConfigure: fixed --with-libatomic=DIR with recent libatomic_ops.
featureAdded "keepalive_min_timeout" directive.
featureSNI: added restriction for TLSv1.3 cross-SNI session resumption.
fixCore: fix build without libcrypt
featureAdd gitignore file.
fixFixed request counting with subrequests in case of error.
fixUpstream: fixed passwords support for dynamic certificates.
+20 more items in the release notes