nginx

Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
*) Bugfix: binary upgrade refused to work if the control API socket was
specified and the new nginx executable was built with the
ngx_http_perl_module.
*) Bugfix: an error while evaluating a predicate in a predicate location
was ignored and the predicate was treated as false.
*) Bugfix: an error during a nested location lookup might be ignored if
locations given by regular expressions or predicates were configured
at the current level.
*) Bugfix: a segmentation fault might occur while reading configuration
if the "geo" directive with the "ranges" parameter was used and the
corresponding binary base file was corrupted.

Changes with nginx 1.31.5 02 Sep 2026
*) Feature: control API.
*) Feature: predicate locations.
*) Feature: the ngx_http_json_module.
*) Feature: the "client_body_early_read" directive.
*) Bugfix: use-after-free might occur in a worker process if proxying
with buffering was used and an error occurred while sending the
response to an HTTP/2 client.
*) Bugfix: a worker process might not exit or "accept4() failed (9: Bad
file descriptor)" alerts might appear in logs if the worker process
ran out of file descriptors before graceful shutdown.
*) Bugfix: requests to FastCGI and uwsgi backends were malformed if a
parameter name was too long.
*) Bugfixes in HTTP/3, ngx_http_slice_module, and
ngx_http_memcached_module.

Changes with nginx 1.31.4 19 Aug 2026
*) Feature: the "proxy_protocol" directive in the stream and mail
modules now supports the PROXY protocol version 2.
*) Change: now HTTP/2 and gRPC requests to backends are always sent with
the ":authority" pseudo-header, and HTTP/1.1 requests - with the
"Host" header.
*) Bugfix: a segmentation fault might occur in a worker process if the
"select" method was used.
*) Bugfix: incomplete gRPC responses with a non-zero "Content-Length"
header line are now treated as malformed.
*) Bugfix: in binary compatibility with third-party modules using script
codes; the bug had appeared in 1.31.3.
*) Bugfix: in the ngx_http_perl_module.
Thanks to David Carlier.
*) Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and
ngx_http_grpc_module.

Changes with nginx 1.31.3 15 Jul 2026
*) Security: heap buffer overflow might occur in a worker process when
using the map directive with regex matching if the map variable was
included in a string expression after a capture affected by this map;
a similar issue might happen when using a non-cacheable variable in a
string expression (CVE-2026-42533).
Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed
regex captures with the "slice" directive or background cache update,
which could result in worker process memory disclosure or worker
process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially
crafted proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434).
Thanks to P4P3R-HAK.
*) Change: the size of headers and trailers in HTTP/2 responses in the
ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with
"proxy_buffer_size" and "grpc_buffer_size" directives.
*) Change: loading of external entities is now disabled in the
(省略されました)

Changes with nginx 1.31.2 17 Jun 2026
*) Security: use-after-free might occur when using HTTP/3 and processing
a specially crafted QUIC session, allowing an attacker to cause
worker process memory corruption or segmentation fault in a worker
process (CVE-2026-42530).
Thanks to Trung Nguyen of CyStack.
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker proccess memory or segmentation fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
(省略されました)

Changes with nginx 1.31.1 22 May 2026
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with overlapping captures in
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-9256).
Thanks to Mufeed VH of Winfunc Research.

Changes with nginx 1.31.0 13 May 2026
*) Security: when using the "proxy_set_body" directive, an attacker
might inject data in the proxied request to an HTTP/2 backend
(CVE-2026-42926).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overflow might occur in a worker
process while handling a specially crafted request by
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-42945).
Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially crafted response by
ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker
to cause a disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-42946).
Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
(省略されました)

Changes with nginx 1.29.8 07 Apr 2026
*) Feature: the "max_headers" directive.
Thanks to Maxim Dounin.
*) Feature: OpenSSL 4.0 compatibility.
*) Feature: now the "include" directive inside the "geo" block supports
wildcards.
*) Bugfix: in processing of HTTP 103 (Early Hints) responses from a
proxied backend.
*) Bugfix: the $request_port and $is_request_port variables were not
available in subrequests.

Changes with nginx 1.29.7 24 Mar 2026
*) Security: a buffer overflow might occur while handling a COPY or MOVE
request in a location with "alias", allowing an attacker to modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module on 32-bit platforms might cause a worker process
crash, or might have potential other impact (CVE-2026-27784).
Thanks to Prabhav Srinath (sprabhav7).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, or might have
potential other impact (CVE-2026-32647).
Thanks to Xint Code and Pavel Kohout (Aisle Research).
*) Security: a segmentation fault might occur in a worker process if the
CRAM-MD5 or APOP authentication methods were used and authentication
retry was enabled (CVE-2026-27651).
Thanks to Arkadi Vainbrand.
(省略されました)

Changes with nginx 1.29.6 10 Mar 2026
*) Feature: session affinity support; the "sticky" directive in the
"upstream" block of the "http" module; the "server" directive
supports the "route" and "drain" parameters.
*) Change: now nginx limits the size and rate of QUIC stateless reset
packets.
*) Bugfix: receiving a QUIC packet by a wrong worker process could cause
the connection to terminate.
*) Bugfix: "[crit] cache file ... contains invalid header" messages
might appear in logs when sending a cached HTTP/2 response.
*) Bugfix: proxying to scgi backends might not work when using chunked
transfer encoding and the "scgi_request_buffering" directive.
Thanks to Mufeed VH.
*) Bugfix: in the ngx_http_mp4_module.
Thanks to Andrew Lacambra.
*) Bugfix: nginx treated a comma as separator in the "Cookie" request
header line when evaluating "$cookie_..." variables.
*) Bugfix: in IMAP command literal argument parsing.

Changes with nginx 1.29.5 04 Feb 2026
*) Security: an attacker might inject plain text data in the response
from an SSL backend (CVE-2026-1642).
*) Bugfix: use-after-free might occur after switching to the next gRPC
or HTTP/2 backend.
*) Bugfix: an invalid HTTP/2 request might be sent after switching to
the next upstream.
*) Bugfix: a response with multiple ranges might be larger than the
source response.
*) Bugfix: fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and
uwsgi backends.
*) Bugfix: fixed warning when compiling with MSVC 2022 x86.
*) Change: the logging level of the "ech_required" SSL error has been
lowered from "crit" to "info".