{"id":183890,"date":"2026-10-15T04:53:55","date_gmt":"2026-10-15T02:53:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/obnovlenie-nginx-1-31-7-i-njs-1-0-2-s-ustraneniem-uyazvimostej"},"modified":"2026-10-15T04:53:59","modified_gmt":"2026-10-15T02:53:59","slug":"nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","title":{"rendered":"Opdatering af nginx 1.31.7 og njs 1.0.2 med sikkerhedsrettelser","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Udgivelsen af den prim\u00e6re gren nginx 1.31.7 er blevet dannet, hvor forts\u00e6ttelsen af udviklingen af nye funktioner finder sted, samt udgivelsen af den parallelt underst\u00f8ttede stabile gren nginx 1.30.6, hvor kun \u00e6ndringer relateret til rettelse af alvorlige fejl og s\u00e5rbarheder tilf\u00f8jes. I opdateringerne er der blevet rettet 5 s\u00e5rbarheder:<\/p>\n
\n
CVE-2026-15176 \u2014 buffer overflow that occurs when using \n the 'alias' directive in configurations that change the request URI through the \n 'rewrite' directive with subsequent redirection to a file.<\/p>\n
CVE-2026-93479 \u2014 buffer overflow occurring when executing string expressions with variables, manifesting during path computation to the root directory and logging requests in the http and stream modules.\n
CVE-2026-95101 \u2014 bypassing the 'client_max_body_size' restriction and injecting third-party data into the proxied request by sending malformed frames in HTTP\/3, part of the content of which might have been processed as the request body.\n
CVE-2026-97629 \u2014 TLS session spoofing due to leaving one of the session keys uninitialized during rotation.\n
CVE-2026-97205 \u2014 use-after-free memory access that occurs when using 'include virtual' commands on SSI pages in conjunction with asynchronous input\/output (AIO).\n<\/ul>\n
Ikke-s\u00e5rbarhedsrelaterede \u00e6ndringer i nginx 1.31.7: <\/p>\n
\n
Modulerne ngx_http_geoip_module og ngx_stream_geoip_module har f\u00e5et tilf\u00f8jet support for databaser i MaxMind (MMDB) format.\n