The release of the main branch of nginx 1.29.4 has been published, continuing the development of new features. Only changes related to fixing serious bugs and vulnerabilities are made in the concurrently supported stable branch 1.28.x. Subsequently, a stable branch 1.30 will be formed based on the main branch 1.29.x. The project code is written in the C language and is distributed under the BSD license.
In the new release:
- Support for the HTTP/2 protocol has been added to the ngx_http_proxy module, allowing the use of HTTP/2 when accessing backends.
- Support for the TLS extension ECH (Encrypted ClientHello) has been added, further developing the ESNI (Encrypted Server Name Indication) extension. This is used to encrypt information about TLS session parameters, such as the requested domain name. The key difference between ECH and ESNI is that in ECH, instead of encrypting specific fields, the entire TLS ClientHello message is encrypted. This helps to prevent leaks through fields not covered by ESNI, such as the PSK (Pre-Shared Key) field. ECH support is enabled by specifying the «ssl_ech_file» directive in the ECHConfig configuration file in PEM format. Support is available with OpenSSL builds that include ECH.
- The rules for checking the host and port in the request text, the "Host" header, and the pseudo-header ":authority" have been aligned with the requirements of RFC 3986.
- Specifying a single newline character as the terminating sequence in chunked requests or response bodies is now treated as an error.
- A crash has been fixed when using HTTP/3 with OpenSSL 3.5.1+.
- A crash of the worker process has been resolved when using the try_files and proxy_pass directives simultaneously with a URI.
Source: opennet.ru
