nginx 1.29.8 → 1.31.6
14 releases · 3 breaking changes · 15 security fixes · 0 advisories fixed
15security3breaking0deprecated21feature44fix
Breaking changes
- breaking GH: remove the set-creation-date.yaml workflow in 1.31.2
- breaking Removed legacy charset directive from default config example. in 1.30.0
- breaking Removed CLOCK_MONOTONIC_FAST support. in 1.30.0
Security changes
- security nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.31.6
- security Updated security policy report methods in 1.31.4
- security nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module… in 1.31.3
- security Nginx 1.31.3 security fixes in 1.31.3
- security nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the… in 1.31.2
- security Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) in 1.31.2
- security nginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). in 1.31.1
- security nginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and… in 1.31.0
- security nginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.30.6
- security nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.30.5
- security nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434). in 1.30.4
- security nginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). in 1.30.3
- security Nginx 1.30.3 with security fixes in 1.30.3
- security nginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). in 1.30.2
- security nginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and… in 1.30.1
Every release in between
securitynginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
otherman page updates
otherHandle predicate location variable error
otherHandle nested location lookup error
fixControl API: fixed socket inheritance on binary upgrade
otherGeo: check binary base CRC32 before relocation
otherQUIC compatibility layer fix
othernginx-1.31.6-RELEASE
featureFastCGI, uWSGI: support for multibyte parameter name lengths
featureAdded client_body_early_read directive
featureAdded the json parser module.
otherCore: make channel file descriptor receive errors non-fatal
otherMemcached: respect the end marker in the maximum supported length
otherQUIC: rejected CRYPTO frames received in 1-RTT packets
otherSlice filter: overflow protection in slice range requests
otherEvent pipe: do not free buffers still used by the downstream
otherPredicate locations
fixJSON: fixed overflow detection in length calculation
otherNGINX Control API
otherUpdated OpenSSL and PCRE used for win32 builds
othernginx-1.31.5-RELEASE
otherXslt: xmlCreatePushParserCtxt() error handling
otherImage filter: bounded size parser reads by received data
securityUpdated security policy report methods
otherAutoindex: use temporary pool for directory entries
fixPerl: fixed $r->print() zero copy with mutable scalars
otherEvents: validate descriptor before FD_SET()
otherFormat specifier fixes in error logging
otherGH: restrict the mark_stale job to nginx/nginx
otherQUIC: apply stream flow control to RESET_STREAM final_size
otherScript: improved compatibility of complex value codes
othergRPC: narrowed special handling of "trailer only" responses
fixFixed overflow detection in chunked parser
otherUpstream: special handling of the "Host" header in HTTP and gRPC
otherUpstream: reject zero WINDOW_UPDATE increments
featureCore: added data model and JSON serialization libraries
fixUpstream: fixed MSVC compilation after dea68dbf126f
otherUpstream: reserved padding in state structures.
otherStream: PROXY protocol version 2 upstream write support
securitynginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module…
otherConfigure: set cache line size for loongarch64
fixHTTP/2: fix overlapping memcpy in CONTINUATION frames
featureAdd missing bounds check in ngx_{http,stream}_compile_complex_value()
fixRevert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames"
otherGH: explicitly set permissions in workflows
otherCharset: disabled charset_map with utf-8 in the first column
otherUpstream: Upgrade header processing
fixFix setting the IPV6_DONTFRAG socket option
otherXslt: disable loading of external entities by default
fixSSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name().
otherFixing HTTP/2 issues
otherPerl fixes
otherConfigure: include crypt.h for crypt() feature tests
otherHTTP/2: Reject requests with pseudo-headers after headers
otherStream and HTTP: rcvbuf and sndbuf directives for upstream sockets
otherTunnel body improvements
securityNginx 1.31.3 security fixes
othernginx-1.31.3-RELEASE
securitynginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the…
otherUse SipHash to speed up $request_id generation
featureSSL: add $ssl_sigalgs variable
fixXslt: fixed handle vsnprintf return value
breakingGH: remove the set-creation-date.yaml workflow
otherSplit clients: improved calculation of range boundaries
otherStyle
fixGH: Fix the whitespace checker workflow
otherSecure link: Compare hashes in constant time
fixAccess log: Fix "request_length" format length
otherUpdated OpenSSL used for win32 builds
securityNginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset)
securitynginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
fixFix the set-creation-date.yaml workflow
otherMp4: avoid adding or comparing to null pointer
otherHTTP/2: limit Content-Type and Location response header length
otherMail error path fixes
otherRewrite: harden escape flags control
fixRewrite: fix buffer overflow with overlapping captures
othernginx-1.31.1-RELEASE
securitynginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
featureGH: add a workflow to check for the 'version bump' commit
otherConnection specific headers
otherUpdated OpenSSL used for win32 builds.
otherSSL: logging level fixes.
otherChanges in ngx_quic_cbs_recv_rcd()
otherSSL: log SSL_R_RECORD_LAYER_FAILURE at info level
otherRestrict duplicate TE headers in HTTP/2 and HTTP/3.
otherHTTP/3: optimize encoder stream memory usage
otherStream: support ALPN for proxy_ssl upstream.
otherPrevent Undefined Behaviour in memcpy(3) via ngx_init_cycle()
featureGH: Add various bits of GitHub automation
featureConfigure: added synonym for the upstream sticky module option
otherStream: evaluate proxy_ssl_alpn once
fixRequest body: fixed empty body buffering special case.
fixConfigure: fix gcc version detection in some corner cases
otherUpstream: least_time load balancing for HTTP and stream.
otherDav: improved path validation for COPY and MOVE operations
fixProxy: fix keepalive for HTTP/2 when no body is specified
otherGH: update the stale PR/issue workflow
otherHTTP CONNECT proxy.
otherReject HTTP CONNECT method with no port after colon
featureGH: set new issues creation date
othernginx-1.31.0-RELEASE
securitynginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherSee official CHANGES-1.30 on nginx.org.
otherBelow is a release summary generated by GitHub.
securitynginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
othernginx-1.30.5-RELEASE
securitynginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).
otherNginx 1.30.4
securitynginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142).
securityNginx 1.30.3 with security fixes
securitynginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
othernginx-1.30.2-RELEASE
securitynginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
othernginx-1.30.1-RELEASE
fixFixed -Wunterminated-string-initialization with gcc15.
fixHTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value.
fixQUIC: fixed a typo.
fixQUIC: fixed sending acknowledgments with limited congestion window.
featureQUIC: using QUIC API introduced in OpenSSL 3.5.
featureCore: added support for TCP keepalive parameters on macOS.
fixUpstream: fixed reinit request with gRPC and Early Hints.
fixPCRE license fix for win32 zip
fixOPENSSL_VERSION_NUMBER fix for OpenSSL 3.0
fixHTTP/3: fixed handling :authority and Host with port.
fixHTTP/2: fixed flushing early hints.
fixHTTP/2 fixes for ":authority" vs "Host"
fixAuth basic: fixed file descriptor leak on memory allocation error.
featureAdded a previously missed changes entry in 1.29.1 relnotes.
breakingRemoved legacy charset directive from default config example.
fixQUIC: fixed ssl_reject_handshake error handling.
fixFixed inaccurate index directive error report
featureAdded F5 CLA workflow.
fixSSL: fixed "key values mismatch" with object cache inheritance.
featureSSL: support for compressed server certificates with BoringSSL.
fixOCSP: fixed invalid type for the 'ssl_ocsp' directive.
fixFixed compilation warnings on Windows after c93a0c48af87.
featureAdding support for pcre 10.47
fixSSL: fixed build with BoringSSL, broken by 38a701d88.
fixProxy: fixed segfault in URI change (issue #983).
fixQuic: fixed segfault on handshake failure
fixFixed duplicate ids in the bug report template.
fixWin32: fixed C4319 warning with MSVC x86.
featureAdd a HTTP_HOST parameter to default_params.
fixProxy: fixed HTTP/2 upstream with caching enabled.
fixFixed separator in parsing header lines with multiple values.
fixSCGI: fixed passing CONTENT_LENGTH in unbuffered mode.
fixResolver: fixed off-by-one read in ngx_resolver_copy().
fixQUIC: fixed bpf compilation with newer Linux kernels.
featureAdded an option to skip the F5 CLA workflow.
featureUpstream: added sticky sessions support for upstreams.
featureLogs: added COMPAT padding to ngx_log_t.
fixUpstream keepalive: fixed parameter parsing.
breakingRemoved CLOCK_MONOTONIC_FAST support.
featureAdded max_headers directive
+78 more items in the release notes