nginx 1.31.6 → 1.31.7
1 release · 0 breaking changes · 1 security fix · 0 advisories fixed
1security0breaking0deprecated3feature1fix
Breaking changes
None in the release notes.
Security changes
- security nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3… in 1.31.7
Every release in between
securitynginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3…
otherDav: destination validation for COPY and MOVE with "alias"
otherVersion bump
otherSSL: set c->error on connection reset SSL_read() error.
featureSSL: support for iPAddress subjectAltName in certificates.
otherRejected zero size in buffer-size directives.
featureHTTP/2: implement RFC 9218 Extensible Prioritization Scheme for HTTP
otherQUIC: support BPF reload and binary upgrade
fixQUIC: fixed binary upgrade from older versions
otherUpdated OpenSSL and PCRE used for win32 builds
featureGeoIP2: support for GeoIP2 http & stream modules