Release of the main branch nginx 1.27.4 has been formed, continuing the development of new features, alongside the parallel support of the stable branch nginx 1.26.3, which only receives changes related to fixing serious bugs and vulnerabilities. The updates address a vulnerability (CVE-2025-23419) that allows bypassing client TLS certificate verification.
The vulnerability is caused by the lack of proper checks when handling virtual hosts bound to a single IP address and port number, selected when accessed via HTTPS based on the domain name specified using the TLS SNI extension. In such configurations, an attacker could reuse a TLS session in the context of another virtual host to bypass authentication with the client TLS certificate. The problem appears in configurations that support TLS session resumption using 'TLS session ticket' or utilize a TLS session cache in settings server by default, where client TLS certificate authentication is used. The vulnerability has existed since the release of nginx 1.11.4 when compiled with OpenSSL and when TLSv1.3 is enabled.
Non-security related changes:
- Features have been added to reduce resource consumption and decrease CPU load when using TLS in configurations with a large number of server and location blocks. The changes allow for instead of creating a separate SSL context (SSL_CTX in OpenSSL) for each configuration block, to use the existing SSL context from the parent block.
- Issues with slow loading of configuration files due to re-parsing the same set of for TLS certificateskeys and certificate authority lists have been resolved. Configuration reloads have been accelerated by reusing unchanged TLS objects such as certificates, keys, and CRLs. To disable object inheritance when updating the configuration, the directive 'ssl_object_cache_inheritable' has been added.
- Caching has been added for certificates and keys loaded using variables in directives (e.g., "ssl_certificate /etc/ssl/$ssl_server_name.crt"). Directives for managing the cache, such as "ssl_certificate_cache", "proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache", and "uwsgi_ssl_certificate_cache", have been added. Through these directives, you can configure the maximum cache size, record expiration time, and the time to clean up unused records. For example: "ssl_certificate_cache max=1000 inactive=20s valid=1m;".
- The directive "keepalive_min_timeout" has been added, defining the timeout during which nginx will not close the keep-alive connection with the client.
- The issue resulting in log messages "gzip filter failed to use preallocated memory" when building with the zlib-ng library has been resolved.
- The issue with building the libatomic library when using the build option "—with-libatomic=DIR" has been resolved.
- A bug that prevented establishing a connection using the QUIC protocol with 0-RTT has been fixed.
- Requests for version negotiation of QUIC from clients will be ignored.
- Issues with building on Solaris 10 with the ngx_http_v3_module have been resolved.
- Errors in the implementation of HTTP/3 have been fixed.
Source: opennet.ru
