nginx-1.31.8 mainline version has been released. See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Version bump by @pluknet in #1846 HTTP/3: avoid undefined behaviour with empty encoder field values by @dgprivate in #1701 Win32: removed the iocp event module by @VadimZhestikov in #1823 Control: logged errors from accepted socket setup. by @OskarEichl…
nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and…
nginx-1.30.6 stable version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and us…
nginx-1.31.5 mainline version has been released, featuring control API, predicate locations, client_body_early_read directive and the ngx_http_json_module. See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed FastCGI, uWSGI: support for multibyte parameter name lengths by @VadimZhestikov in #1648 Added client_body_early_read directive by @arut in #1641…
nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). See official CHANGES-1.30 on nginx.org. Below is a release summary generated by GitHub. What's Changed nginx-1.30.5-RELEASE by @pluknet in #1772 Full Changelog: release-1.30.4...release-1.30.5
nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439). See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed man page updates by @pluknet in #1727 Handle predicate location variable error by @arut in #1750 Handle nested location lookup error by @arut in #1751 Control A…
nginx-1.31.4 mainline version has been released. See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Xslt: xmlCreatePushParserCtxt() error handling by @VadimZhestikov in #1565 Image filter: bounded size parser reads by received data by @VadimZhestikov in #1574 Updated security policy report methods by @pluknet in #1586 Autoindex: use temporary pool for…
nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434). See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed…
nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434). See official CHANGES-1.30 on nginx.org. Below is a release summary generated by GitHub. What's Chan…
nginx-1.30.3 stable version has been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). See official CHANGES-1.30 on nginx.org. Below is a release summary generated by GitHub. What's Changed Nginx 1.30.3 with security fixes by @arut in #1…
nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). See official CHANGES on nginx.org. Below is a release summary generated by…
nginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Fix the set-creation-date.yaml workflow by @ac000 in #1353 Mp4: avoid adding or comparing to null pointer by @arut in #1360 HTTP/2: limit Content-Type and Locat…
nginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256). See official CHANGES-1.30 on nginx.org. Below is a release summary generated by GitHub. What's Changed nginx-1.30.2-RELEASE by @pluknet in #1397 Full Changelog: release-1.30.1...release-1.30.2
nginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-20…
nginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026…
nginx-1.30.0 stable version has been released, incorporating new features and bug fixes from the 1.29.x mainline branch — including Early Hints, HTTP/2 to backend and Encrypted ClientHello, sticky sessions support for upstreams, Multipath TCP support, the default proxy HTTP version set to HTTP/1.1 with keep-alive enabled, and more. What's Changed Version bump 1.29.0 by @arut in #632 QUIC: silence…
nginx-1.29.8 mainline version has been released. See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Fixed the "include" directive inside the "geo" block. by @jimf5 in #1184 SSL: compatibility with OpenSSL 4.0. by @pluknet in #1183 Update CONTRIBUTING.md by @xuruidong in #1195 Upstream: fixed processing multiple 103 (early hints) responses. by @pluknet…
nginx-1.29.7 mainline version has been released, introducing two significant updates: support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled. This release also includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-…
nginx-1.28.3 stable version has been released. This release includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), security fixes for the mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753), and a security f…