The release of the main branch nginx 1.31.0 has been formed, which continues to develop new features, as well as the release of the concurrently supported stable branch nginx 1.30.1, where only changes related to serious bugs and vulnerabilities are made. The updates fix 6 vulnerabilities, the most dangerous of which allows for remote code execution through a specially crafted HTTP request. At the time of writing this news, fixes for angie and freenginx have not been published.
The vulnerability (CVE-2026-42945), assigned a critical severity level, is caused by a buffer overflow in the ngx_http_rewrite_module, which can be exploited to execute code with the nginx worker process's privileges by sending an HTTP request with a specially crafted URI. The issue manifests in configurations with the "rewrite" directive where regular expressions use mask substitutions via unnamed variables (e.g., $1 and $2), given that the replacement string contains a "?" character. An example of a vulnerable construct: rewrite ^\/users\/([0-9]+)\/profile\/(.*)$ \/profile.php?id=$1&tab=$2 last;
Constructs with named substitutions are not vulnerable. For example, the vulnerability does not affect constructs like: rewrite ^\/users\/(?[0-9]+)\/profile\/(?
The vulnerability has been present since version 0.6.27, released in March 2008. The cause of the vulnerability was that the buffer was allocated with the expectation that it would store unescaped data, but in fact, it copied data after special character escaping, the size of which was larger because each symbol ‘+’, ‘%’ and ‘&’ was encoded as more than one byte. Such a mismatch occurred because when the rewrite rule contained the symbol '?', the flag 'e->is_args' was set, which enabled escaping, but the buffer allocation occurred with the flag reset, during which escaping was not applied.
Other vulnerabilities:
- CVE-2026-42926 — the potential for the attacker's data to be injected into the proxied request when using the "proxy_set_body" directive in the settings and accessing the backend via HTTP/2 (proxy_http_version=2).
- CVE-2026-40701 — a use-after-free memory access in the ngx_http_ssl_module that occurs when processing responses from a DNS server in configurations with the "ssl_ocsp" directive.
- CVE-2026-42946 — a buffer overflow read in the ngx_http_uwsgi_module and ngx_http_scgi_module that arises when processing specially crafted responses. This issue may lead to a memory content leak or crash of the worker process.
- CVE-2026-42934 — a buffer overflow read in the worker process that occurs when processing responses decoded from UTF-8 encoding when using the "charset_map" directive. This issue may lead to a memory content leak or crash of the worker process.
- CVE-2026-40460 — a vulnerability in the implementation of the HTTP/3 protocol that allows spoofing. an IP address to bypass authorization or restrictions.
Improvements added in the nginx 1.31.0 release:
- The ngx_http_tunnel_module has been included, enabling operation as a forward proxy that redirects requests to another server when a client uses the HTTP/1.1 CONNECT method. Authentication for proxy access can be configured using the "auth_basic", "satisfy", and "auth_delay" directives.
- The "upstream" block has been enhanced with the "least_time" directive, which includes a load balancing method that forwards the request based on the least average response time and the fewest active connections. server to the server with the least average response time and fewest active connections.
- The "stream_proxy" module has been updated with the "proxy_ssl_alpn" directive to specify the list of protocols allowed in the ALPN extension when connecting to the proxied server. For example: "proxy_ssl_alpn h2 http/1.1".
- Requests using HTTP/2 and HTTP/3 protocols that include the "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding", and "Upgrade" headers are now rejected.
- In the ngx_http_dav_module, requests for COPY and MOVE with repeated source and target resources or nested collections are now rejected.
- The error logging level for SSL "invalid alert", "record layer failure", and "SSL alert number N" has been reduced from "crit" to "info."
- The configure script has been updated with the parameter "—without-http_upstream_sticky_module" to disable the building of the http_upstream_sticky_module (the parameter "—without-http_upstream_sticky" has been deprecated).
Note: An exploit for the RCE vulnerability in ngx_http_rewrite_module is now available.
Source: opennet.ru
