The release of the main branch nginx 1.29.7 has been formed, continuing the development of new features, alongside the release of the parallel stable branch nginx 1.28.3, which only receives changes related to fixing serious bugs and vulnerabilities. The updates have resolved 6 vulnerabilities, three of which lead to buffer overflows. Four vulnerabilities have been assigned a high severity level (8.8 or 8.5 out of 10).
- CVE-2026-27654 — buffer overflow in the ngx_http_dav_module when processing WebDAV requests COPY and MOVE with the 'alias' directive in location blocks. This vulnerability allows altering file paths to access outside the base directory. The issue was identified using the AI model Claude.
- CVE-2026-27784, CVE-2026-32647 — buffer overflows in the ngx_http_mp4_module occurring when processing specially crafted mp4 files. Exploitation of the vulnerability may not be limited to crashing the worker process.
- CVE-2026-27651 — null pointer dereference due to improper use of the CRAM-MD5 or APOP authentication methods.
- CVE-2026-28753 — the ability to manipulate PTR records in DNS to inject attacker data into auth_http requests and into the XCLIENT command in SMTP connections to the backend.
- CVE-2026-28755 — bypass of the certificate OCSP check result in the stream module.
Among the non-security related changes in nginx 1.29.7
- Support for Multipath TCP (MPTCP) has been added, allowing packets to be delivered simultaneously over multiple routes through different network interfaces. A 'multipath' parameter has been added to the 'listen' directive to enable this.
- A 'local' parameter has been added to the 'keepalive' directive used in the upstream block. When this parameter is specified, instead of sharing a single connection to a common upstream server mentioned in different location and server blocks, a separate connection to the upstream is maintained for each block.
- The 'keepalive' directive has been enabled by default in the upstream block.
- When using the proxy mode, the default version of the HTTP protocol is set to HTTP/1.1 with keep-alive mode enabled (keep-alive support is enabled by default in the ngx_http_proxy_module, and the value '1.1' is set in the 'proxy_http_version' directive, and the 'Connection' header is no longer sent by default). To revert to the old behavior, allowing access to backends that only support HTTP/1.0, the following settings should be configured: proxy_http_version 1.0; proxy_set_header Connection 'Close';
Source: opennet.ru
