NGINX Releases

NGINX 1.31.2

2026-06-17 00:00:00

Use-after-free might occur when using HTTP/3 and processing a specially crafted QUIC session, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-42530).
A heap memory buffer overflow might occur in a worker process when using a configuration with "ignore_invalid_headers off;" and "large_client_header_buffers" with large configured values when proxying a specially crafted request to HTTP/2 or gRPC backend, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-42055).
A heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-48142).

A variable defined by the "split_clients" directive might be empty if all percentages were specified explicitly and summed up to 100%.
Constant time "secure_link" hash comparison.

2026-05-22 00:00:00

A heap memory buffer overflow might occur in a worker process when using a configuration with overlapping captures in ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-9256).

2026-05-13 00:00:00

When using the "proxy_set_body" directive, an attacker might inject data in the proxied request to an HTTP/2 backend (CVE-2026-42926).
A heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-42945).
A heap memory buffer overread might occur in a worker process while handling a specially crafted response by ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946).
A heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-42934).
When using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing (CVE-2026-40460).
Use-after-free might occur during DNS server response processing if the "ssl_ocsp" directive was used, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-40701).

Now nginx rejects HTTP/2 and HTTP/3 requests with the "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding", "Upgrade" header lines, and "TE" with any value other than "trailers".
The ngx_http_dav_module now rejects a COPY or MOVE requests when the source and destination resources are the same or have a parent-child collection relationship.
The logging level of the "invalid alert" and "record layer failure" SSL errors, and of the "SSL alert number N" for any alert numbers has been lowered from "crit" to "info".
Now the "sticky" module can be disabled with the --without-http_upstream_sticky_module configure option; the --without-http_upstream_sticky configure option is deprecated.

The ngx_http_tunnel_module; support for authenticating to proxies in the "auth_basic", "satisfy", and "auth_delay" directives.
The "least_time" directive inside the "upstream" block.
The "proxy_ssl_alpn" directive in the stream module.

Connections with HTTP/2 backends might not be cached when using the "proxy_set_body" or "proxy_pass_request_body" directives.
Proxied HTTP/0.9, SCGI, or uWSGI responses might be transferred incorrectly if the first line was not fully read.

2026-04-07 00:00:00

In processing of HTTP 103 (Early Hints) responses from a proxied backend.
The $request_port and $is_request_port variables were not available in subrequests.

2026-03-24 00:00:00

A buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). io in collaboration with Claude and Anthropic Research.
Processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784).
Processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647).
A segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651).
An attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753).
SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755).

Now the "keepalive" directive in the "upstream" block is enabled by default.
Now ngx_http_proxy_module supports keepalive by default; the default value for "proxy_http_version" is "1.1"; the "Connection" proxy header is not sent by default anymore.

An invalid HTTP/2 request might be sent after switching to the next upstream if buffered body was used in the ngx_http_grpc_module.