{"id":183890,"date":"2026-10-15T04:53:55","date_gmt":"2026-10-15T02:53:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/obnovlenie-nginx-1-31-7-i-njs-1-0-2-s-ustraneniem-uyazvimostej"},"modified":"2026-10-15T04:53:59","modified_gmt":"2026-10-15T02:53:59","slug":"nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","title":{"rendered":"Aktualizace nginx 1.31.7 a njs 1.0.2 s odstran\u011bn\u00edm zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Byla vyd\u00e1na nov\u00e1 verze hlavn\u00ed v\u011btve nginx 1.31.7, v r\u00e1mci n\u00ed\u017e je pokra\u010dov\u00e1no ve v\u00fdvoji nov\u00fdch funkc\u00ed, a tak\u00e9 byla vyd\u00e1na paraleln\u011b podporovan\u00e1 stabiln\u00ed v\u011btev nginx 1.30.6, do kter\u00e9 jsou p\u0159id\u00e1v\u00e1ny pouze zm\u011bny souvisej\u00edc\u00ed s odstran\u011bn\u00edm z\u00e1va\u017en\u00fdch chyb a zranitelnost\u00ed. V aktualizac\u00edch bylo odstran\u011bno 5 zranitelnost\u00ed:<\/p>\n
\n
CVE-2026-15176 \u2014 p\u0159ete\u010den\u00ed bufferu, kter\u00e9 se projevuje p\u0159i pou\u017eit\u00ed \n direktivy \u201ealias\u201c v konfigurac\u00edch, kter\u00e9 m\u011bn\u00ed URI dotazu prost\u0159ednictv\u00edm direktivy \n \u201erewrite\u201c s dal\u0161\u00edm p\u0159esm\u011brov\u00e1n\u00edm na soubor.<\/p>\n
CVE-2026-93479 \u2014 p\u0159ete\u010den\u00ed bufferu, kter\u00e9 nast\u00e1v\u00e1 p\u0159i vykon\u00e1v\u00e1n\u00ed \u0159et\u011bzcov\u00fdch v\u00fdraz\u016f s prom\u011bnn\u00fdmi a projevuje se p\u0159i v\u00fdpo\u010dtu cesty k ko\u0159enov\u00e9mu adres\u00e1\u0159i a p\u0159i logov\u00e1n\u00ed dotaz\u016f v modulech http a stream.\n
CVE-2026-95101 \u2014 obch\u00e1zen\u00ed omezen\u00ed \u201eclient_max_body_size\u201c a vkl\u00e1d\u00e1n\u00ed ciz\u00edch dat do proxy dotazu prost\u0159ednictv\u00edm p\u0159ed\u00e1n\u00ed nespr\u00e1vn\u00fdch r\u00e1mc\u016f v HTTP\/3, jejich\u017e \u010d\u00e1st mohla b\u00fdt zpracov\u00e1na jako t\u011blo dotazu.\n
CVE-2026-97629 \u2014 podvr\u017een\u00ed TLS relac\u00ed z d\u016fvodu ponech\u00e1n\u00ed jednoho z registra\u010dn\u00edch kl\u00ed\u010d\u016f nezinitializovan\u00e9ho b\u011bhem rotace.\n
CVE-2026-97205 \u2014 p\u0159\u00edstup k pam\u011bti po jej\u00edm uvoln\u011bn\u00ed (use-after-free), kter\u00fd vznik\u00e1 p\u0159i pou\u017eit\u00ed na SSI str\u00e1nk\u00e1ch p\u0159\u00edkaz\u016f \u201einclude virtual\u201c v kombinaci s pou\u017eit\u00edm asynchronn\u00edho vstupu\/v\u00fdstupu (AIO).\n<\/ul>\n
Nevztahuj\u00edc\u00ed se k zranitelnostem zm\u011bny v nginx 1.31.7: <\/p>\n
\n
Do modul\u016f ngx_http_geoip_module a ngx_stream_geoip_module byla p\u0159id\u00e1na podpora datab\u00e1z\u00ed ve form\u00e1tu MaxMind (MMDB).\n