nginx 1.30.2 → 1.31.8
13 releases · 2 breaking changes · 14 security fixes · 0 advisories fixed
14security2breaking0deprecated13feature21fix
Breaking changes
- breaking Win32: removed the iocp event module in 1.31.8
- breaking GH: remove the set-creation-date.yaml workflow in 1.31.2
Security changes
- security nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.31.7
- security nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.31.6
- security Updated security policy report methods in 1.31.4
- security nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module… in 1.31.3
- security Nginx 1.31.3 security fixes in 1.31.3
- security nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the… in 1.31.2
- security Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) in 1.31.2
- security nginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). in 1.31.1
- security nginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and… in 1.31.0
- security nginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.30.6
- security nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.30.5
- security nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434). in 1.30.4
- security nginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). in 1.30.3
- security Nginx 1.30.3 with security fixes in 1.30.3
Every release in between
otherVersion bump
otherHTTP/3: avoid undefined behaviour with empty encoder field values
breakingWin32: removed the iocp event module
otherControl: logged errors from accepted socket setup.
otherDav: restored the request URI on a destination mapping error
otherSSL: ignored EIO after shutdown with kernel TLS
otherSSL: workaround for i2d_SSL_SESSION() negative values
otherControl API: use more portable ioctl(FIOASYNC)
fixFixed Priority parsing of large integers on 32-bit platforms
otherJSON: parser API refactoring.
fixFixed a typo
otherGH: workflow to generate windows zip
otherGH: request an id token and pass secrets to a callee in buildbot.yml
fixMisc: fixed "zip" target with GNU sed
otherHTTP/3: avoid unaligned stores in Huffman encoding
otherworking_directory fixes
othernginx-1.31.8-RELEASE
securitynginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherDav: destination validation for COPY and MOVE with "alias"
otherVersion bump
otherSSL: set c->error on connection reset SSL_read() error.
featureSSL: support for iPAddress subjectAltName in certificates.
otherRejected zero size in buffer-size directives.
featureHTTP/2: implement RFC 9218 Extensible Prioritization Scheme for HTTP
otherQUIC: support BPF reload and binary upgrade
fixQUIC: fixed binary upgrade from older versions
otherUpdated OpenSSL and PCRE used for win32 builds
featureGeoIP2: support for GeoIP2 http & stream modules
securitynginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
otherman page updates
otherHandle predicate location variable error
otherHandle nested location lookup error
fixControl API: fixed socket inheritance on binary upgrade
otherGeo: check binary base CRC32 before relocation
otherQUIC compatibility layer fix
othernginx-1.31.6-RELEASE
featureFastCGI, uWSGI: support for multibyte parameter name lengths
featureAdded client_body_early_read directive
featureAdded the json parser module.
otherCore: make channel file descriptor receive errors non-fatal
otherMemcached: respect the end marker in the maximum supported length
otherQUIC: rejected CRYPTO frames received in 1-RTT packets
otherSlice filter: overflow protection in slice range requests
otherEvent pipe: do not free buffers still used by the downstream
otherPredicate locations
fixJSON: fixed overflow detection in length calculation
otherNGINX Control API
otherUpdated OpenSSL and PCRE used for win32 builds
othernginx-1.31.5-RELEASE
otherXslt: xmlCreatePushParserCtxt() error handling
otherImage filter: bounded size parser reads by received data
securityUpdated security policy report methods
otherAutoindex: use temporary pool for directory entries
fixPerl: fixed $r->print() zero copy with mutable scalars
otherEvents: validate descriptor before FD_SET()
otherFormat specifier fixes in error logging
otherGH: restrict the mark_stale job to nginx/nginx
otherQUIC: apply stream flow control to RESET_STREAM final_size
otherScript: improved compatibility of complex value codes
othergRPC: narrowed special handling of "trailer only" responses
fixFixed overflow detection in chunked parser
otherUpstream: special handling of the "Host" header in HTTP and gRPC
otherUpstream: reject zero WINDOW_UPDATE increments
featureCore: added data model and JSON serialization libraries
fixUpstream: fixed MSVC compilation after dea68dbf126f
otherUpstream: reserved padding in state structures.
otherStream: PROXY protocol version 2 upstream write support
securitynginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module…
otherConfigure: set cache line size for loongarch64
fixHTTP/2: fix overlapping memcpy in CONTINUATION frames
featureAdd missing bounds check in ngx_{http,stream}_compile_complex_value()
fixRevert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames"
otherGH: explicitly set permissions in workflows
otherCharset: disabled charset_map with utf-8 in the first column
otherUpstream: Upgrade header processing
fixFix setting the IPV6_DONTFRAG socket option
otherXslt: disable loading of external entities by default
fixSSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name().
otherFixing HTTP/2 issues
otherPerl fixes
otherConfigure: include crypt.h for crypt() feature tests
otherHTTP/2: Reject requests with pseudo-headers after headers
otherStream and HTTP: rcvbuf and sndbuf directives for upstream sockets
otherTunnel body improvements
securityNginx 1.31.3 security fixes
othernginx-1.31.3-RELEASE
securitynginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the…
otherUse SipHash to speed up $request_id generation
featureSSL: add $ssl_sigalgs variable
fixXslt: fixed handle vsnprintf return value
breakingGH: remove the set-creation-date.yaml workflow
otherSplit clients: improved calculation of range boundaries
otherStyle
fixGH: Fix the whitespace checker workflow
otherSecure link: Compare hashes in constant time
fixAccess log: Fix "request_length" format length
otherUpdated OpenSSL used for win32 builds
securityNginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset)
securitynginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
fixFix the set-creation-date.yaml workflow
otherMp4: avoid adding or comparing to null pointer
otherHTTP/2: limit Content-Type and Location response header length
otherMail error path fixes
otherRewrite: harden escape flags control
fixRewrite: fix buffer overflow with overlapping captures
othernginx-1.31.1-RELEASE
securitynginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and…
featureGH: add a workflow to check for the 'version bump' commit
otherConnection specific headers
otherUpdated OpenSSL used for win32 builds.
otherSSL: logging level fixes.
otherChanges in ngx_quic_cbs_recv_rcd()
otherSSL: log SSL_R_RECORD_LAYER_FAILURE at info level
otherRestrict duplicate TE headers in HTTP/2 and HTTP/3.
otherHTTP/3: optimize encoder stream memory usage
otherStream: support ALPN for proxy_ssl upstream.
otherPrevent Undefined Behaviour in memcpy(3) via ngx_init_cycle()
featureGH: Add various bits of GitHub automation
featureConfigure: added synonym for the upstream sticky module option
otherStream: evaluate proxy_ssl_alpn once
fixRequest body: fixed empty body buffering special case.
fixConfigure: fix gcc version detection in some corner cases
otherUpstream: least_time load balancing for HTTP and stream.
otherDav: improved path validation for COPY and MOVE operations
fixProxy: fix keepalive for HTTP/2 when no body is specified
otherGH: update the stale PR/issue workflow
otherHTTP CONNECT proxy.
otherReject HTTP CONNECT method with no port after colon
featureGH: set new issues creation date
othernginx-1.31.0-RELEASE
securitynginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherSee official CHANGES-1.30 on nginx.org.
otherBelow is a release summary generated by GitHub.
securitynginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
othernginx-1.30.5-RELEASE
securitynginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).
otherNginx 1.30.4
securitynginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142).
securityNginx 1.30.3 with security fixes