nginx 1.31.1 → 1.31.8
7 releases · 2 breaking changes · 7 security fixes · 0 advisories fixed
7security2breaking0deprecated9feature16fix
Breaking changes
- breaking Win32: removed the iocp event module in 1.31.8
- breaking GH: remove the set-creation-date.yaml workflow in 1.31.2
Security changes
- security nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.31.7
- security nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). in 1.31.6
- security Updated security policy report methods in 1.31.4
- security nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module… in 1.31.3
- security Nginx 1.31.3 security fixes in 1.31.3
- security nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the… in 1.31.2
- security Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) in 1.31.2
Every release in between
otherVersion bump
otherHTTP/3: avoid undefined behaviour with empty encoder field values
breakingWin32: removed the iocp event module
otherControl: logged errors from accepted socket setup.
otherDav: restored the request URI on a destination mapping error
otherSSL: ignored EIO after shutdown with kernel TLS
otherSSL: workaround for i2d_SSL_SESSION() negative values
otherControl API: use more portable ioctl(FIOASYNC)
fixFixed Priority parsing of large integers on 32-bit platforms
otherJSON: parser API refactoring.
fixFixed a typo
otherGH: workflow to generate windows zip
otherGH: request an id token and pass secrets to a callee in buildbot.yml
fixMisc: fixed "zip" target with GNU sed
otherHTTP/3: avoid unaligned stores in Huffman encoding
otherworking_directory fixes
othernginx-1.31.8-RELEASE
securitynginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherDav: destination validation for COPY and MOVE with "alias"
otherVersion bump
otherSSL: set c->error on connection reset SSL_read() error.
featureSSL: support for iPAddress subjectAltName in certificates.
otherRejected zero size in buffer-size directives.
featureHTTP/2: implement RFC 9218 Extensible Prioritization Scheme for HTTP
otherQUIC: support BPF reload and binary upgrade
fixQUIC: fixed binary upgrade from older versions
otherUpdated OpenSSL and PCRE used for win32 builds
featureGeoIP2: support for GeoIP2 http & stream modules
securitynginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).
otherman page updates
otherHandle predicate location variable error
otherHandle nested location lookup error
fixControl API: fixed socket inheritance on binary upgrade
otherGeo: check binary base CRC32 before relocation
otherQUIC compatibility layer fix
othernginx-1.31.6-RELEASE
featureFastCGI, uWSGI: support for multibyte parameter name lengths
featureAdded client_body_early_read directive
featureAdded the json parser module.
otherCore: make channel file descriptor receive errors non-fatal
otherMemcached: respect the end marker in the maximum supported length
otherQUIC: rejected CRYPTO frames received in 1-RTT packets
otherSlice filter: overflow protection in slice range requests
otherEvent pipe: do not free buffers still used by the downstream
otherPredicate locations
fixJSON: fixed overflow detection in length calculation
otherNGINX Control API
otherUpdated OpenSSL and PCRE used for win32 builds
othernginx-1.31.5-RELEASE
otherXslt: xmlCreatePushParserCtxt() error handling
otherImage filter: bounded size parser reads by received data
securityUpdated security policy report methods
otherAutoindex: use temporary pool for directory entries
fixPerl: fixed $r->print() zero copy with mutable scalars
otherEvents: validate descriptor before FD_SET()
otherFormat specifier fixes in error logging
otherGH: restrict the mark_stale job to nginx/nginx
otherQUIC: apply stream flow control to RESET_STREAM final_size
otherScript: improved compatibility of complex value codes
othergRPC: narrowed special handling of "trailer only" responses
fixFixed overflow detection in chunked parser
otherUpstream: special handling of the "Host" header in HTTP and gRPC
otherUpstream: reject zero WINDOW_UPDATE increments
featureCore: added data model and JSON serialization libraries
fixUpstream: fixed MSVC compilation after dea68dbf126f
otherUpstream: reserved padding in state structures.
otherStream: PROXY protocol version 2 upstream write support
securitynginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module…
otherConfigure: set cache line size for loongarch64
fixHTTP/2: fix overlapping memcpy in CONTINUATION frames
featureAdd missing bounds check in ngx_{http,stream}_compile_complex_value()
fixRevert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames"
otherGH: explicitly set permissions in workflows
otherCharset: disabled charset_map with utf-8 in the first column
otherUpstream: Upgrade header processing
fixFix setting the IPV6_DONTFRAG socket option
otherXslt: disable loading of external entities by default
fixSSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name().
otherFixing HTTP/2 issues
otherPerl fixes
otherConfigure: include crypt.h for crypt() feature tests
otherHTTP/2: Reject requests with pseudo-headers after headers
otherStream and HTTP: rcvbuf and sndbuf directives for upstream sockets
otherTunnel body improvements
securityNginx 1.31.3 security fixes
othernginx-1.31.3-RELEASE
securitynginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the…
otherUse SipHash to speed up $request_id generation
featureSSL: add $ssl_sigalgs variable
fixXslt: fixed handle vsnprintf return value
breakingGH: remove the set-creation-date.yaml workflow
otherSplit clients: improved calculation of range boundaries
otherStyle
fixGH: Fix the whitespace checker workflow
otherSecure link: Compare hashes in constant time
fixAccess log: Fix "request_length" format length
otherUpdated OpenSSL used for win32 builds
securityNginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset)