nginx 1.29.1 → 1.31.6
21 releases · 5 breaking changes · 17 security fixes · 0 advisories fixed
17security5breaking0deprecated30feature67fix
Breaking changes
- breaking GH: remove the set-creation-date.yaml workflow in 1.31.2
- breaking Removed legacy charset directive from default config example. in 1.30.0
- breaking Removed CLOCK_MONOTONIC_FAST support. in 1.30.0
- breaking Removed CLOCK_MONOTONIC_FAST support. in 1.29.8
- breaking Removed legacy charset directive from default config example. in 1.29.2
Security changes
- security nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.31.6
- security Updated security policy report methods in 1.31.4
- security nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module… in 1.31.3
- security Nginx 1.31.3 security fixes in 1.31.3
- security nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the… in 1.31.2
- security Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) in 1.31.2
- security nginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). in 1.31.1
- security nginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and… in 1.31.0
- security nginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.30.6
- security nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.30.5
- security nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434). in 1.30.4
- security nginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). in 1.30.3
- security Nginx 1.30.3 with security fixes in 1.30.3
- security nginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). in 1.30.2
- security nginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and… in 1.30.1
- security nginx-1.29.7 mainline version has been released, introducing two significant updates: support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled. This release also includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module… in 1.29.7
- security nginx-1.29.5 mainline version has been released. This release includes a security fix for the SSL upstream injection vulnerability (CVE-2026-1642). See official CHANGES on nginx.org. in 1.29.5
Every release in between
securitynginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
otherman page updates
otherHandle predicate location variable error
otherHandle nested location lookup error
fixControl API: fixed socket inheritance on binary upgrade
otherGeo: check binary base CRC32 before relocation
otherQUIC compatibility layer fix
othernginx-1.31.6-RELEASE
featureFastCGI, uWSGI: support for multibyte parameter name lengths
featureAdded client_body_early_read directive
featureAdded the json parser module.
otherCore: make channel file descriptor receive errors non-fatal
otherMemcached: respect the end marker in the maximum supported length
otherQUIC: rejected CRYPTO frames received in 1-RTT packets
otherSlice filter: overflow protection in slice range requests
otherEvent pipe: do not free buffers still used by the downstream
otherPredicate locations
fixJSON: fixed overflow detection in length calculation
otherNGINX Control API
otherUpdated OpenSSL and PCRE used for win32 builds
othernginx-1.31.5-RELEASE
otherXslt: xmlCreatePushParserCtxt() error handling
otherImage filter: bounded size parser reads by received data
securityUpdated security policy report methods
otherAutoindex: use temporary pool for directory entries
fixPerl: fixed $r->print() zero copy with mutable scalars
otherEvents: validate descriptor before FD_SET()
otherFormat specifier fixes in error logging
otherGH: restrict the mark_stale job to nginx/nginx
otherQUIC: apply stream flow control to RESET_STREAM final_size
otherScript: improved compatibility of complex value codes
othergRPC: narrowed special handling of "trailer only" responses
fixFixed overflow detection in chunked parser
otherUpstream: special handling of the "Host" header in HTTP and gRPC
otherUpstream: reject zero WINDOW_UPDATE increments
featureCore: added data model and JSON serialization libraries
fixUpstream: fixed MSVC compilation after dea68dbf126f
otherUpstream: reserved padding in state structures.
otherStream: PROXY protocol version 2 upstream write support
securitynginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module…
otherConfigure: set cache line size for loongarch64
fixHTTP/2: fix overlapping memcpy in CONTINUATION frames
featureAdd missing bounds check in ngx_{http,stream}_compile_complex_value()
fixRevert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames"
otherGH: explicitly set permissions in workflows
otherCharset: disabled charset_map with utf-8 in the first column
otherUpstream: Upgrade header processing
fixFix setting the IPV6_DONTFRAG socket option
otherXslt: disable loading of external entities by default
fixSSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name().
otherFixing HTTP/2 issues
otherPerl fixes
otherConfigure: include crypt.h for crypt() feature tests
otherHTTP/2: Reject requests with pseudo-headers after headers
otherStream and HTTP: rcvbuf and sndbuf directives for upstream sockets
otherTunnel body improvements
securityNginx 1.31.3 security fixes
othernginx-1.31.3-RELEASE
securitynginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the…
otherUse SipHash to speed up $request_id generation
featureSSL: add $ssl_sigalgs variable
fixXslt: fixed handle vsnprintf return value
breakingGH: remove the set-creation-date.yaml workflow
otherSplit clients: improved calculation of range boundaries
otherStyle
fixGH: Fix the whitespace checker workflow
otherSecure link: Compare hashes in constant time
fixAccess log: Fix "request_length" format length
otherUpdated OpenSSL used for win32 builds
securityNginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset)
securitynginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
fixFix the set-creation-date.yaml workflow
otherMp4: avoid adding or comparing to null pointer
otherHTTP/2: limit Content-Type and Location response header length
otherMail error path fixes
otherRewrite: harden escape flags control
fixRewrite: fix buffer overflow with overlapping captures
othernginx-1.31.1-RELEASE
securitynginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
featureGH: add a workflow to check for the 'version bump' commit
otherConnection specific headers
otherUpdated OpenSSL used for win32 builds.
otherSSL: logging level fixes.
otherChanges in ngx_quic_cbs_recv_rcd()
otherSSL: log SSL_R_RECORD_LAYER_FAILURE at info level
otherRestrict duplicate TE headers in HTTP/2 and HTTP/3.
otherHTTP/3: optimize encoder stream memory usage
otherStream: support ALPN for proxy_ssl upstream.
otherPrevent Undefined Behaviour in memcpy(3) via ngx_init_cycle()
featureGH: Add various bits of GitHub automation
featureConfigure: added synonym for the upstream sticky module option
otherStream: evaluate proxy_ssl_alpn once
fixRequest body: fixed empty body buffering special case.
fixConfigure: fix gcc version detection in some corner cases
otherUpstream: least_time load balancing for HTTP and stream.
otherDav: improved path validation for COPY and MOVE operations
fixProxy: fix keepalive for HTTP/2 when no body is specified
otherGH: update the stale PR/issue workflow
otherHTTP CONNECT proxy.
otherReject HTTP CONNECT method with no port after colon
featureGH: set new issues creation date
othernginx-1.31.0-RELEASE
securitynginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherSee official CHANGES-1.30 on nginx.org.
otherBelow is a release summary generated by GitHub.
securitynginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
othernginx-1.30.5-RELEASE
securitynginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).
otherNginx 1.30.4
securitynginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142).
securityNginx 1.30.3 with security fixes
securitynginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
othernginx-1.30.2-RELEASE
securitynginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
othernginx-1.30.1-RELEASE
fixFixed -Wunterminated-string-initialization with gcc15.
fixHTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value.
fixQUIC: fixed a typo.
fixQUIC: fixed sending acknowledgments with limited congestion window.
featureQUIC: using QUIC API introduced in OpenSSL 3.5.
featureCore: added support for TCP keepalive parameters on macOS.
fixUpstream: fixed reinit request with gRPC and Early Hints.
fixPCRE license fix for win32 zip
fixOPENSSL_VERSION_NUMBER fix for OpenSSL 3.0
fixHTTP/3: fixed handling :authority and Host with port.
fixHTTP/2: fixed flushing early hints.
fixHTTP/2 fixes for ":authority" vs "Host"
fixAuth basic: fixed file descriptor leak on memory allocation error.
featureAdded a previously missed changes entry in 1.29.1 relnotes.
breakingRemoved legacy charset directive from default config example.
fixQUIC: fixed ssl_reject_handshake error handling.
fixFixed inaccurate index directive error report
featureAdded F5 CLA workflow.
fixSSL: fixed "key values mismatch" with object cache inheritance.
featureSSL: support for compressed server certificates with BoringSSL.
fixOCSP: fixed invalid type for the 'ssl_ocsp' directive.
fixFixed compilation warnings on Windows after c93a0c48af87.
featureAdding support for pcre 10.47
fixSSL: fixed build with BoringSSL, broken by 38a701d88.
fixProxy: fixed segfault in URI change (issue #983).
fixQuic: fixed segfault on handshake failure
fixFixed duplicate ids in the bug report template.
fixWin32: fixed C4319 warning with MSVC x86.
featureAdd a HTTP_HOST parameter to default_params.
fixProxy: fixed HTTP/2 upstream with caching enabled.
fixFixed separator in parsing header lines with multiple values.
fixSCGI: fixed passing CONTENT_LENGTH in unbuffered mode.
fixResolver: fixed off-by-one read in ngx_resolver_copy().
fixQUIC: fixed bpf compilation with newer Linux kernels.
featureAdded an option to skip the F5 CLA workflow.
featureUpstream: added sticky sessions support for upstreams.
featureLogs: added COMPAT padding to ngx_log_t.
fixUpstream keepalive: fixed parameter parsing.
breakingRemoved CLOCK_MONOTONIC_FAST support.
featureAdded max_headers directive
+78 more items in the release notesfixFixed the "include" directive inside the "geo" block.
otherSSL: compatibility with OpenSSL 4.0.
otherUpdate CONTRIBUTING.md
fixUpstream: fixed processing multiple 103 (early hints) responses.
breakingRemoved CLOCK_MONOTONIC_FAST support.
fixUpstream: fix integer underflow in charset parsing
featureAdded max_headers directive
fixfix $request_port / $is_request_port being empty if auth_request is used
otherUpstream: reset early_hints_length on upstream reinit.
othernginx-1.29.8-RELEASE
securitynginx-1.29.7 mainline version has been released, introducing two significant updates: support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled. This release also includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module…
otherVersion bump 1.29.7.
otherProxy authentication definitions.
otherProxy: reset pending control frames on HTTP/2 upstream reinit.
othergRPC: reset buffer chains on upstream reinit.
otherMultipath TCP support
featureLogs: added COMPAT padding to ngx_log_t.
otherUpstream keepalive: enabled keepalive module by default.
fixUpstream keepalive: fixed parameter parsing.
otherMp4: avoid zero size buffers in output.
fixMp4: fixed possible integer overflow on 32-bit platforms.
otherDav: destination length validation for COPY and MOVE.
otherMail: host validation.
fixMail: fixed clearing s->passwd in auth http requests.
fixStream: fixed client certificate validation with OCSP.
othernginx-1.29.7-RELEASE
otherVersion bump.
fixProxy: fixed HTTP/2 upstream with caching enabled.
fixFixed separator in parsing header lines with multiple values.
fixSCGI: fixed passing CONTENT_LENGTH in unbuffered mode.
otherMp4: validate sync sample values in stss atom.
fixResolver: fixed off-by-one read in ngx_resolver_copy().
otherQUIC Stateless Reset improvements
fixQUIC: fixed bpf compilation with newer Linux kernels.
otherUpdating welcome page with links and more details.
otherQUIC: worker-bound stateless reset tokens.
otherQUIC: handle compat keylog callback errors
featureAdded an option to skip the F5 CLA workflow.
otherIMAP bugfixes.
featureUpstream: added sticky sessions support for upstreams.
othernginx-1.29.6 changes
securitynginx-1.29.5 mainline version has been released. This release includes a security fix for the SSL upstream injection vulnerability (CVE-2026-1642). See official CHANGES on nginx.org.
fixFixed duplicate ids in the bug report template.
otherSSL: logging level of the "ech_required" TLS alert.
fixWin32: fixed C4319 warning with MSVC x86.
featureAdd a HTTP_HOST parameter to default_params.
otherYear 2026.
otherRange filter: reasonable limit on multiple ranges.
otherMisc: moved documentation in generated ZIP archive.
otherDocs: Clarify -t option behavior in nginx man page
otherProxy v2 request body fixes.
otherUpdated OpenSSL and PCRE used for win32 builds.
otherUpstream read before write
othernginx-1.29.5-RELEASE
otherConfigure: ensure we get the "built by ..." line in nginx -V.
featureAdding support for pcre 10.47
otherSSL: changed interface of ngx_ssl_set_client_hello_callback().
fixSSL: fixed build with BoringSSL, broken by 38a701d88.
otherHTTP/2: extended guard for NULL buffer and zero length.
otherValidate host
fixProxy: fixed segfault in URI change (issue #983).
otherOpenSSL ECH integration
otherUpdate community health files
otherSSL: avoid warning when ECH is not configured and not supported.
otherDisabled bare LF in chunked transfer encoding.
otherHTTP/2 to upstream
fixQuic: fixed segfault on handshake failure
othernginx-1.29.4-RELEASE
featureSSL: support for compressed server certificates with BoringSSL.
otherHTTP CONNECT infrastructure
otherUpstream: reset local address in case of error.
otherSSL: $ssl_sigalg, $ssl_client_sigalg. initial work
otherGeo: the "volatile" parameter.
otherInheritance control for add_header and add_trailer.
fixOCSP: fixed invalid type for the 'ssl_ocsp' directive.
fixFixed compilation warnings on Windows after c93a0c48af87.
otherModules compatibility: increased compat section size.
othernginx-1.29.3 changes
featureAdded a previously missed changes entry in 1.29.1 relnotes.
breakingRemoved legacy charset directive from default config example.
fixQUIC: fixed ssl_reject_handshake error handling.
otherUpdated link to xslscript.
fixFixed inaccurate index directive error report
otherSNI: using ClientHello callback.
otherAWS-LC support changes
otherUpstream: overflow detection in Cache-Control delta-seconds.
otherMail: xtext encoding (RFC 3461) in XCLIENT LOGIN.
featureAdded F5 CLA workflow.
fixSSL: fixed "key values mismatch" with object cache inheritance.
othernginx-1.29.2 changes